Security readout for executives and security teams
Plain-English summary
Delta Electronics DOPSoft 4.0.10.17 and earlier can read outside intended memory while handling project files. The reported impact is information disclosure. This is most relevant where engineering workstations open DOPSoft project files from partners, backups, removable media, or shared repositories.
Executive priority
Treat this as a targeted OT engineering-workstation risk, not a broad internet-facing emergency based on current evidence. Prioritize environments that exchange DOPSoft project files externally or rely on shared engineering workstations.
Technical view
CVE-2021-27455 is a CWE-125 out-of-bounds read in Delta Electronics DOPSoft project-file processing. The public record names DOPSoft 4.0.10.17 and prior as affected and states the issue may allow information disclosure. No CVSS vector is provided in the supplied bundle.
Likely exposure
Exposure is likely limited to systems where Delta Electronics DOPSoft is installed, especially OT or HMI engineering workstations that open project files. The bundle does not identify network services, cloud exposure, or affected runtime devices.
Exploitation context
The source bundle does not report active exploitation, and the CVE is not marked as CISA KEV. The described trigger is processing project files, so risk depends on whether users open untrusted or tampered DOPSoft project files.
Researcher notes
Evidence is limited to the CVE record and CISA ICS advisory reference. The bundle identifies affected versions and weakness type, but not CVSS, exploit maturity, patch details, or deeper parser internals. Avoid asserting device-level compromise from this record alone.
Mitigation direction
- Inventory DOPSoft installations and identify versions 4.0.10.17 or earlier.
- Check Delta Electronics and CISA guidance for an approved fixed version or mitigation.
- Restrict opening DOPSoft project files from untrusted sources.
- Handle project-file exchange through trusted repositories and malware-scanned channels.
- Limit DOPSoft use to managed engineering workstations with least privilege.
Validation and detection
- Confirm installed DOPSoft versions on engineering workstations.
- Review file-handling workflows for external or removable project files.
- Check whether vendor guidance has been applied to affected installations.
- Verify users understand not to open unexpected DOPSoft project files.
- Document affected hosts, owners, and remediation status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-27455 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://us-cert.cisa.gov/ics/advisories/icsa-21-182-03CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.