WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash.
WPLSoft en Delta Electronics en versiones 2.45.0 y anteriores emplea un búfer de memoria dinámica (heap) con un tamaño fijo en el que un valor más grande que el búfer puede ser leído en en el búfer desde un archivo. Esto provoca que el búfer se sobrescriba, lo que podría permitir la ejecución remota de código o que la aplicación se cierre inesperadamente.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of dvp files. Crafted data in a .dvp file can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process.
