OTPulse

Delta Electronics DTM Soft

MonitorCVSS 7.8ICS-CERT ICSA-26-176-06Jun 25, 2026
Delta Electronics
Attack path
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Delta Electronics DTMSoft contains a code execution vulnerability (CWE-502) that allows attackers to execute arbitrary code by delivering a malicious project file to a user. All versions of DTMSoft are affected. The vulnerability is triggered when a user opens a crafted project file without verifying its source. Exploitation with administrator privileges amplifies the risk by enabling full system access.

What this means
What could happen
An attacker could execute arbitrary code on an engineering workstation running DTMSoft by tricking a user into opening a malicious project file, potentially allowing unauthorized control of connected Delta industrial equipment or access to configuration data.
Who's at risk
Organizations managing Delta Electronics equipment (VFDs, motion controllers, PLCs, power conversion devices) through DTMSoft engineering workstations are affected. This concerns facilities and utilities where engineers use DTMSoft to configure, program, or troubleshoot Delta industrial hardware.
How it could be exploited
An attacker crafts a malicious DTMSoft project file and delivers it via email, network share, or USB drive. When an authorized user opens the file in DTMSoft, the embedded malicious code executes with the user's privileges. If the user has administrative access, the attacker gains full code execution on the workstation, which may have network access to PLCs, VFDs, or other Delta equipment.
Prerequisites
  • User must open a malicious project file in DTMSoft
  • User must be socially engineered or tricked into opening unsolicited file
  • If administrator privileges are used, impact is amplified
No authentication required to exploitLow complexity attack (requires user interaction)Arbitrary code execution on engineering workstationNo patch available yet
Affected products (1)
ProductAffected VersionsFix Status
DTMSoftAll versionsNo fix yet
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDDo not open unsolicited project files, untrusted links, or unexpected email attachments from unknown sources; always verify file source before opening
WORKAROUNDRun DTMSoft with standard user privileges instead of administrator privileges
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXMonitor for vendor patch availability and apply when released
Long-term hardening
0/1
HARDENINGRestrict DTMSoft workstation network access to only required Delta equipment using firewall rules
View full CISA ICS-CERT advisory
API: /api/v1/advisories/dccbc83f-0bae-497c-b11d-b62d39bff2f5

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.