Delta Electronics Delta Industrial Automation DOPSoft DPS File wScreenDESCTextLen Buffer Overflow Remote Code Execution

Vulnerability

A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wScreenDESCTextLen field of a DPS file [1]. The affected product is end-of-life and no patches are available [1]. The vulnerability is triggered when a user opens a specially crafted DPS file.

Exploitation

An anonymous attacker can exploit this vulnerability by enticing a user to open a malicious DPS file [1]. No authentication is required, but user interaction is necessary. The attacker crafts a DPS file with an oversized wScreenDESCTextLen field, causing a buffer overflow when parsed by DOPSoft.

Impact

Successful exploitation allows the attacker to achieve remote code execution on the victim's machine, with the same privileges as the user running DOPSoft [1]. This can lead to full compromise of the affected system.

Mitigation

The product is end-of-life and no patches are available [1]. Users are advised to consider upgrading to a supported product or implementing network segmentation and user awareness training to mitigate the risk of opening untrusted DPS files.