Delta Electronics vulnerabilities

226 vulnerabilities

Known vulnerabilities in Delta Electronics products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 37 products.

Products

37
7.8CVE-2018-14800delta_electronicsispsoft+1
EPSS score
1.63%
Delta Electronics ISPSoft version 3.0.5 and prior allow an attacker, by opening a crafted file, to cause the application to read past the boundary allocated to a stack object, which could allow execution of code under the context of the application.6.5CVE-2018-14824delta electronicsdelta industrial automation pmsoft+1
EPSS score
2.00%
Delta Electronics Delta Industrial Automation PMSoft v2.11 or prior has an out-of-bounds read vulnerability that can be executed when processing project files, which may allow an attacker to read confidential information.7.8CVE-2018-17927delta electronicsdelta industrial automation tpeditor+1
EPSS score
2.11%
In Delta Industrial Automation TPEditor, TPEditor Versions 1.90 and prior, multiple out-of-bounds write vulnerabilities may be exploited by processing specially crafted project files lacking user input validation, which may cause the system to write outside the intended buffer area and may allow remote code execution.7.8CVE-2018-17929delta electronicsdelta industrial automation tpeditor+1
EPSS score
1.75%
In Delta Industrial Automation TPEditor, TPEditor Versions 1.90 and prior, multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files lacking user input validation before copying data from project files onto the stack and may allow an attacker to remotely execute arbitrary code.9.8CVE-2018-10623delta electronicsdelta industrial automation dopsoft+1
EPSS score
3.53%
Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior performs read operations on a memory buffer where the position can be determined by a value read from a .dpa file. This may cause improper restriction of operations within the bounds of the memory buffer, allow remote code execution, alter the intended control flow, allow reading of sensitive information, or cause the application to crash.9.8CVE-2018-10617delta electronicsdelta industrial automation dopsoft+1
EPSS score
3.53%
Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length heap buffer where a value larger than the buffer can be read from a .dpa file into the buffer, causing the buffer to be overwritten. This may allow remote code execution or cause the application to crash.9.8CVE-2018-10621delta electronicsdelta industrial automation dopsoft+1
EPSS score
3.53%
Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length stack buffer where a value larger than the buffer can be read from a .dpa file into the buffer, causing the buffer to be overwritten. This may allow remote code execution or cause the application to crash.9.8CVE-2018-8871delta electronicsautomation tpeditor+1
EPSS score
3.82%
In Delta Electronics Automation TPEditor version 1.89 or prior, parsing a malformed program file may cause heap-based buffer overflow vulnerability, which may allow remote code execution.7.8CVE-2018-8839delta_electronicspmsoft+1
EPSS score
0.46%
Delta PMSoft versions 2.10 and prior have multiple stack-based buffer overflow vulnerabilities where a .ppm file can introduce a value larger than is readable by PMSoft's fixed-length stack buffer. This can cause the buffer to be overwritten, which may allow arbitrary code execution or cause the application to crash. CVSS v3 base score: 7.1; CVSS vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. Delta Electronics recommends affected users update to at least PMSoft v2.11, which was made available as of March 22, 2018, or the latest available version.6.5CVE-2021-31558delta electronicsdiaenergie+1
EPSS score
10.56%
DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr” of the script “DIAE_hierarchyHandler.ashx”.7.8CVE-2021-43982delta electronicscncsoft+1
EPSS score
9.59%
Delta Electronics CNCSoft Versions 1.01.30 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.5.5CVE-2021-38411delta electronicsdialink+1
EPSS score
0.64%
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remotely execute code.5.5CVE-2021-38428delta electronicsdialink+1
EPSS score
11.43%
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code.7.8CVE-2021-38424delta electronicsdialink+1
EPSS score
0.51%
The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.5.5CVE-2021-38403delta electronicsdialink+1
EPSS score
0.64%
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter supplier of the API maintenance, which may allow an attacker to remotely execute code.8.8CVE-2021-38418delta electronicsdialink+1
EPSS score
0.57%
Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization.7.8CVE-2021-38402delta electronicsdopsoft 2+1
EPSS score
7.12%
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could lead to a stack-based buffer overflow while trying to copy to a buffer during font string handling. An attacker could leverage this vulnerability to execute code in the context of the current process.7.8CVE-2021-38404delta electronicsdopsoft 2+1
EPSS score
1.04%
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.5.5CVE-2021-38407delta electronicsdialink+1
EPSS score
0.64%
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices, which may allow an attacker to remotely execute code.7.8CVE-2021-38416delta electronicsdialink+1
EPSS score
0.26%
Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed.