Delta Electronics vulnerabilities
We track 147 vulnerabilities in Delta Electronics products across 23 products. 147 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 30, 2026.
Latest Delta Electronics vulnerabilities
- 8.8 High severity
CNCSoft-G2: Out-of-bounds Write
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to exec
- 7.5 High severity
DIAEnergie: Uncontrolled Resource Consumption
A denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.
- 9.8 Critical severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQL
- 9.8 Critical severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
A SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform S
- 8.8 High severity
DIAEnergie: Improper Limitation of a Pathname to a Restricted Directory
Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file wi
- 8.8 High severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.
- 8.8 High severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.
- 7.8 High severity
CNCSoft-G2 DOPSoft: Stack-based Buffer Overflow
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
- 8.1 High severity
DIAEnergie: Improper Limitation of a Pathname to a Restricted Directory
It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.
- 8.8 High severity
DIAEnergie: Improper Limitation of a Pathname to a Restricted Directory
Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten.
- 8.8 High severity
DIAEnergie: Client-Side Enforcement of Server-Side Security
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.
- 7.8 High severity
CNCSoft-B: Out-of-bounds Write
Delta Electronics CNCSoft-B versions 1.0.0.4 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
- 7.8 High severity
CNCSoft-B v1.0.0.4 DOPSoft: Uncontrolled Search Path Element
Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82 insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.
- 8.8 High severity
ISPSoft: Out-of-bounds Write
A heap buffer-overflow exists in Delta Electronics ISPSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.
- 8.8 High severity
WPLSoft: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in Delta Electronics WPLSoft. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DVP file to achieve code execution.
- 7.8 High severity
DOPSoft: Buffer Copy without Checking Size of Input
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted D
- 7.8 High severity
DOPSoft: Buffer Copy without Checking Size of Input
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS
- 7.8 High severity
DOPSoft: Buffer Copy without Checking Size of Input
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesTimeLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially craft
- 7.8 High severity
DOPSoft: Buffer Copy without Checking Size of Input
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesActionLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially cra
- 7.8 High severity
DOPSoft: Buffer Copy without Checking Size of Input
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wLogTitlesPrevValueLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially
- 7.8 High severity
DOPSoft: Buffer Copy without Checking Size of Input
A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the InitialMacroLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted
- 7.8 High severity
DOPSoft: Buffer Copy without Checking Size of Input
A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution.
- 7.8 High severity
DOPSoft: Buffer Copy without Checking Size of Input
A buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wMailContentLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to ac
- 7.8 High severity
DOPSoft: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wKPFStringLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DP
- 7.8 High severity
DOPSoft: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wScreenDESCTextLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially craft
- 7.8 High severity
DOPSoft: Out-of-bounds Write
Delta Electronics DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file.
- 7.5 High severity
InfraSuite Device Master: Improper Limitation of a Pathname to a Restricted Directory
In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a single UDP packet, obtain plaintext credentials, or perform NTLM relaying.
- 9.8 Critical severity
InfraSuite Device Master: Deserialization of Untrusted Data
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute code with local administrator privileges.
- 8.8 High severity
InfraSuite Device Master: Improper Limitation of a Pathname to a Restricted Directory
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, which could lead to remote code execution.
- 9.8 Critical severity
InfraSuite Device Master: Exposed Dangerous Method or Function
In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a single UDP packet.
- 7.5 High severity
DVP32ES2 PLC: Improper Resource Shutdown or Release
A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Password Transmission Handler. The manipulation leads to denial of service. The exploit has been disclose
- 7.8 High severity
DIAScreen: Out-of-bounds Write
Delta Electronics DIAScreen may write past the end of an allocated buffer while parsing a specially crafted input file. This could allow an attacker to execute code in the context of the current process.
- 7.5 High severity
Infrasuite Device Master: Files or Directories Accessible to External Parties
An attacker could bypass the latest Delta Electronics InfraSuite Device Master (versions prior to 1.0.7) patch, which could allow an attacker to retrieve file contents.
- 9.8 Critical severity
Infrasuite Device Master: Improper Privilege Management
Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management configurations, resulting in privilege escalation.
- 9.8 Critical severity
Infrasuite Device Master: Deserialization of Untrusted Data
Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contains classes that cannot be deserialized, which could allow an attack to remotely execute arbitrary code.
- 7.8 High severity
CNCSoft-B DOPSoft: Stack-based Buffer Overflow
Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
- 7.8 High severity
CNCSoft-B DOPSoft: Out-of-bounds Write
Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitrary code.
- 9.0 Critical severity
DX-2100-L1-CN: Improper Neutralization of Input During Web Page Generation
The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system (OS) from the device in the context of the user "root." If the attacker has creden
- 7.8 High severity
InfraSuite Device Master: Deserialization of Untrusted Data
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code executi
- 8.8 High severity
InfraSuite Device Master: Incorrect Authorization
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.