Delta Electronics TPEditor

An attacker who tricks an engineer into opening a malicious TPEditor project file could execute arbitrary commands on the engineering workstation, allowing them to modify automation logic, steal configuration files, or disrupt program development. In the worst case, compromised automation code could be deployed to control systems, affecting plant operations.

Engineering teams and operators who use Delta TPEditor to configure and manage Delta industrial automation equipment, including programmable logic controllers (PLCs), power management devices, and motor drives. This affects anyone creating, editing, or deploying automation program files on Windows engineering workstations.

An attacker crafts a malicious TPEditor project file (.tpe or similar) designed to trigger a buffer overflow or out-of-bounds write when opened. The attacker sends this file via email or hosts it on a website and socially engineers an engineer to open it using TPEditor. Upon opening, the memory corruption vulnerability executes the attacker's payload, which could run commands with the privileges of the engineering workstation user.