CVE-2025-22883 Delta Electronics CVE debrief

Who should care

OT/ICS teams using Delta Electronics ISPSoft, engineering workstation owners, automation engineers, plant security teams, and vulnerability management teams responsible for Windows-based engineering tools used to open DVP project files.

Technical summary

The advisory describes a memory corruption condition in ISPSoft's DVP file parsing logic. A crafted DVP file can trigger an out-of-bounds write, which may lead to arbitrary code execution. The supplied CVSS vector indicates local attack conditions with required user interaction (AV:L/UI:R), no privileges needed, and potential high impact to confidentiality, integrity, and availability.

Defensive priority

High for any organization that uses ISPSoft in operational or engineering workflows, particularly where DVP files may be transferred from external parties or shared across trust boundaries. Patch prioritization should be elevated for exposed engineering workstations and shared file-handling environments.

Recommended defensive actions

• Update Delta Electronics ISPSoft to version 3.21 or later, as recommended in the vendor advisory.
• Inventory engineering workstations and confirm which systems have ISPSoft version 3.19 or earlier installed.
• Treat DVP files from outside trusted workflows as untrusted input and review file-handling procedures accordingly.
• Reduce exposure of engineering workstations by following CISA ICS recommended practices, including segmentation and limiting unnecessary software on critical systems.
• Use application control, least privilege, and workstation hardening measures appropriate for ICS engineering environments.
• Monitor vendor and CISA advisories for any follow-up guidance or corrections related to CVE-2025-22883.

Evidence notes

Primary evidence comes from the CISA CSAF advisory for ICSA-25-119-02, which identifies Delta Electronics ISPSoft versions 3.19 and prior as affected by an out-of-bounds write during DVP parsing and states that updating to v3.21 or later is the vendor recommendation. The CVSS 3.1 vector and score are included in the supplied source item metadata. The advisory was initially published on 2025-04-29 and revised on 2025-05-06 for typo fixes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.