CVE-2023-43821 is a high severity (CVSS 8.8) stack based buffer overflow in Delta Electronics Delta Industrial Automation DOPSoft. It is triggered when the software parses the wLogTitlesActionLen field of a DPS file. The fix status is unclear, so treat untrusted DPS files as unsafe and confirm with the vendor.
What's affected
The record names Delta Electronics DOPSoft and does not list a version range. The Exodus Intelligence write up for the first CVE in this series, CVE-2023-43820, does not name affected versions either. It states that the affected product is end of life and that no patches are available. Read the write up for this specific CVE to see whether anything differs.
The record scores the issue 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That vector means a network attack, low complexity, no privileges and user interaction required. In plain terms, the attacker needs a person to open a crafted file. Exodus lists a CVSS v2 score of 6.8 for CVE-2023-43820, which is a different scoring system and not a disagreement about severity.
The weaknesses are CWE-119, CWE-120, classic memory corruption flaws. The record does not mark this CVE as known exploited, and the Exodus page does not claim exploitation.
How to check if you're exposed
DOPSoft is the programming tool for Delta human machine interfaces, so it usually sits on engineering workstations.
- List the machines where DOPSoft is installed. Windows Settings, then Apps, shows the product and version.
- Note which of those machines can reach production networks or hold project files from outside parties.
- Ask your Delta Electronics contact or your integrator which DOPSoft release you run and whether a newer one addresses this CVE. The record gives no fixed version.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Treat every DPS file from an email, a download or a shared drive as untrusted until you know who made it.
- Open DPS files only from sources you control, and keep DOPSoft off general purpose machines used for browsing and email.
- Ask Delta Electronics whether a fixed release exists. Do not assume one does, since the Exodus write up says the product is end of life.
- If no fix exists, plan a move to a supported programming tool and keep a copy of your project files in a read only archive.
- Limit who can reach engineering workstations from the plant network, and log file transfers to them.
Why it matters
A stack based buffer overflow happens when a program copies data into a fixed size area of memory without checking the length first. Here the length field read from the DPS file (wLogTitlesActionLen) is not validated properly, so a crafted file can overwrite memory next to the buffer. On a desktop tool that can lead to code running as the user who opened the file.
Industrial programming software is a quiet target. The files travel between integrators, vendors and plant staff, and the machines that open them often have a path to controllers. A file based bug turns that trust into a risk. Because this CVE is part of a series of near identical length field flaws, closing one input path does not mean the parser is safe.
Quick check
Does CVE-2023-43821 need a network connection to the victim?
The vector says network, but the record also says the attacker must entice a user to open a crafted DPS file. In practice the file has to reach the user and be opened.
Is there a fixed version?
The record does not list one. The Exodus Intelligence write up for CVE-2023-43820 says the product is end of life and no patches are available, so confirm with Delta Electronics.
Sources
- Exodus Intelligence write up (record reference)
- Exodus write up for CVE-2023-43820, fetched for status
Last reviewed: 19 October 2026.
