PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-22882 Delta Electronics CVE debrief

Delta Electronics ISPSoft versions 3.19 and earlier are affected by a stack-based buffer overflow that can be triggered while parsing CBDGL files. According to the advisory, the flaw may let an attacker leverage debugging logic to execute arbitrary code. Delta recommends upgrading to ISPSoft v3.21 or later.

Vendor
Delta Electronics
Product
ISPSoft
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-29
Original CVE updated
2025-05-06
Advisory published
2025-04-29
Advisory updated
2025-05-06

Who should care

Organizations that use Delta Electronics ISPSoft, especially engineering, automation, and OT teams that open or process CBDGL files on affected systems. Security teams managing industrial control software should treat this as a high-priority patch item because successful exploitation could lead to code execution on the workstation handling the file.

Technical summary

CISA’s CSAF advisory describes a stack-based buffer overflow in ISPSoft affecting versions 3.19 and prior. The issue is tied to parsing CBDGL files and is rated CVSS 3.1 7.8 High with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access with user interaction is part of the attack conditions. The vendor remediation is to update to ISPSoft v3.21 or later.

Defensive priority

High. The combination of code execution potential, user-interaction requirements, and industrial software context makes this a strong near-term patching candidate for any environment that opens untrusted or externally sourced project files.

Recommended defensive actions

  • Update Delta Electronics ISPSoft to v3.21 or later as recommended by the vendor.
  • Identify systems that use ISPSoft 3.19 or earlier, including engineering workstations and shared lab systems.
  • Restrict handling of untrusted CBDGL files until affected systems are patched.
  • Use standard ICS defense-in-depth practices for engineering endpoints and file-transfer workflows.
  • Review Delta’s advisory for any additional vendor guidance or environment-specific mitigations.

Evidence notes

This debrief is based on the CISA CSAF advisory for ICSA-25-119-02 / CVE-2025-22882 and the vendor remediation guidance included in the source corpus. The advisory states that ISPSoft versions 3.19 and prior are vulnerable and recommends updating to v3.21 or later. The source revision history shows an initial publication on 2025-04-29 and a follow-up revision on 2025-05-06 for typo fixes only.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-22882 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-22882

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-22882 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-22882

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-119-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-119-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.