CVE-2021-22660: Delta Industrial Automation CNCSoft-B DOPSoft DPA File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Reference Links

• https://us-cert.cisa.gov/ics/advisories/icsa-21-110-05
• https://www.zerodayinitiative.com/advisories/ZDI-21-445/
• https://www.zerodayinitiative.com/advisories/ZDI-21-446/
• https://www.zerodayinitiative.com/advisories/ZDI-21-509/
• https://www.cisa.gov/news-events/ics-advisories/icsa-21-110-05 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-21-110-05

Frequently Asked Questions

• What is the vulnerability ID for this Delta Industrial Automation CNCSoft-B DOPSoft vulnerability?

  The vulnerability ID for this Delta Industrial Automation CNCSoft-B DOPSoft vulnerability is CVE-2021-22660.

• What is the severity of CVE-2021-22660?

  The severity of CVE-2021-22660 is high with a severity value of 7.8.

• How can remote attackers exploit CVE-2021-22660?

  Remote attackers can exploit CVE-2021-22660 by executing arbitrary code on affected installations of Delta Industrial Automation CNCSoft-B DOPSoft. User interaction is required by visiting a malicious page or opening a malicious file.

• Which software is affected by CVE-2021-22660?

  Delta Industrial Automation CNCSoft-B DOPSoft versions up to and including 1.0.0.3 are affected by CVE-2021-22660.

• How can I fix the Delta Industrial Automation CNCSoft-B DOPSoft vulnerability (CVE-2021-22660)?

  To fix the Delta Industrial Automation CNCSoft-B DOPSoft vulnerability (CVE-2021-22660), it is recommended to apply the latest security patches or updates provided by Delta Industrial Automation.