WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length stack buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash.
WPLSoft en Delta Electronics en versiones 2.45.0 y anteriores emplea un búfer de pila con un tamaño fijo en el que un valor más grande que el búfer puede ser leído en en el búfer desde un archivo. Esto provoca que el búfer se sobrescriba, lo que podría permitir la ejecución remota de código o que la aplicación se cierre inesperadamente.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft and Delta Industrial Automation ISPSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of dvp files. The process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of current process.
