CVE-2021-38402 Delta Electronics DOPSoft 2 Stack-Based Buffer Overflow

2021-09-1718:54:37

CWE-121

icscert

www.cve.org

delta electronics

dopsoft 2

buffer overflow

font string handling

validation

code execution

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.017

Percentile

88.1%

JSON

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could lead to a stack-based buffer overflow while trying to copy to a buffer during font string handling. An attacker could leverage this vulnerability to execute code in the context of the current process.

CNA Affected

[
  {
    "product": "DOPSoft 2",
    "vendor": "Delta Electronics",
    "versions": [
      {
        "lessThanOrEqual": "2.00.07",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]