PatchSiren cyber security CVE debrief

CVE-2024-8255 Delta Electronics CVE debrief

Delta Electronics DTN Soft versions 2.0.1 and prior contain a deserialization of untrusted data vulnerability that can lead to remote code execution. The vulnerability was disclosed by CISA on August 29, 2024, with a CVSS 3.1 score of 7.8 (HIGH). The attack vector is local, requiring user interaction but no privileges, and can result in complete confidentiality, integrity, and availability compromise of the affected system. Delta Electronics has released version 2.1 to address this vulnerability.

Vendor: Delta Electronics
Product: DTN Soft
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-08-29
Original CVE updated: 2024-08-29
Advisory published: 2024-08-29
Advisory updated: 2024-08-29

Who should care

Organizations using Delta Electronics DTN Soft for industrial control system configuration or management, particularly in operational technology (OT) environments where DTN Soft is deployed for device programming and network configuration.

Technical summary

CVE-2024-8255 is a deserialization of untrusted data vulnerability in Delta Electronics DTN Soft versions 2.0.1 and prior. Successful exploitation allows an attacker to achieve remote code execution with high impact to confidentiality, integrity, and availability. The CVSS 3.1 attack vector is local with required user interaction, indicating the vulnerability is likely triggered through malicious file or data processing. Delta Electronics has released DTN Soft version 2.1 as a vendor fix.

Defensive priority

HIGH

Recommended defensive actions

Update Delta Electronics DTN Soft to version 2.1 immediately
Verify current DTN Soft version through application settings or installation records
If immediate patching is not possible, restrict local access to systems running DTN Soft and avoid opening untrusted files
Monitor for suspicious process execution or unexpected network connections from DTN Soft hosts
Review ICS-CERT recommended practices for defense-in-depth strategies for industrial control systems

Evidence notes

CISA ICS Advisory ICSA-24-242-02 published 2024-08-29 confirms Delta Electronics DTN Soft <=2.0.1 is vulnerable to deserialization of untrusted data leading to remote code execution. CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields score 7.8. Vendor fix available via Delta Electronics Download Center.

Official resources

2024-08-29