Delta Electronics ASDA-Soft
Plan Patch7.8ICS-CERT ICSA-26-048-02Feb 17, 2026
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
ASDA-Soft versions 7.2.0.0 and earlier contain a stack-based buffer overflow vulnerability (CWE-121). The flaw allows an attacker to write arbitrary data beyond the bounds of a stack-allocated buffer, corrupting the structured exception handler (SEH) and enabling arbitrary code execution. The vulnerability is triggered when a user opens or interacts with a malicious file. Delta has released version 7.2.2.0 to correct this issue.
What this means
What could happen
An attacker could overwrite the stack exception handler in ASDA-Soft, allowing arbitrary code execution on engineering workstations that run the software. This could compromise the ability to safely configure or monitor Delta motor drives and automation equipment.
Who's at risk
This affects any organization that uses Delta ASDA-Soft v7.2.0.0 or earlier to configure and monitor Delta servo drives, AC drives, and motor controllers on production lines or utility control systems. Engineering and automation teams who use the software are at immediate risk if they open untrusted files.
How it could be exploited
An attacker crafts a malicious file or network message that triggers a stack buffer overflow in ASDA-Soft. When an engineer opens the file or the software processes the message, the overflow corrupts the structured exception handler (SEH), allowing the attacker to redirect execution to arbitrary code. This requires user interaction (opening a file or clicking a link).
Prerequisites
- ASDA-Soft version 7.2.0.0 or earlier must be installed on an engineering workstation
- User must open or interact with a malicious file or message crafted to trigger the overflow
- No special network access or credentials required
Low complexity attack requiring user interactionNo authentication neededAffects engineering workstations that control critical industrial equipmentPotential to achieve arbitrary code execution on devices that configure safety-critical systems
Exploitability
Low exploit probability (EPSS 0.0%)
Affected products (1)
ProductAffected VersionsFix Status
ASDA-Soft: <=7.2.0.0≤ 7.2.0.0v7.2.2.0
Remediation & Mitigation
0/4
Do now
0/2HARDENINGDo not click on untrusted internet links or open unsolicited email attachments that may contain malicious files
HARDENINGRestrict ASDA-Soft to engineering workstations on isolated networks, away from Internet exposure
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate ASDA-Soft to version 7.2.2.0 or later from Delta Download Center
Long-term hardening
0/1HARDENINGFor remote access to engineering workstations running ASDA-Soft, require VPN or other secure tunneling rather than direct Internet exposure
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/45a12c54-e2ea-4c08-b6a6-f675b8a12916