Delta Electronics WPLSoft, ISPSoft, and PMSoft Vulnerabilities

An attacker could achieve arbitrary code execution on an engineering workstation running these tools, allowing modification of controller configurations, ladder logic, or process parameters that could disrupt water/power operations when pushed to devices.

Engineering teams at water authorities, municipal electric utilities, and other infrastructure operators who use Delta Electronics controller programming tools (WPLSoft for HMI/SCADA, ISPSoft for programmable relays, PMSoft for power monitoring devices). Risk is highest where engineers receive external project files or collaborate with third-party integrators.

An attacker sends a malicious file (project file, configuration file, or import file) to an engineer. When the engineer opens the file in WPLSoft, ISPSoft, or PMSoft, the buffer overflow is triggered and the attacker's code runs with the privileges of the engineering workstation. The attacker could then modify industrial device configurations or create malicious logic.