Delta ASDA-Soft CVE-2025-62579

Exploitation requires an attacker to supply a maliciously crafted file (e.g., an ASDA-Soft project/configuration file) AND a local user to open it in the ASDA-Soft application - this is the user interaction captured by UI:R and the local vector AV:L. There is no network-reachable service; the attacker cannot trigger the overflow remotely or without victim action. Limiting factors that reduce real-world risk: the software is specialized engineering/commissioning tooling for Delta servo drives (small installed base, typically on isolated OT or engineering workstations), successful code execution runs only at the privilege level of the user who opened the file, and the attack depends entirely on social-engineering the victim into opening an untrusted file. No special product configuration setting is named in the description beyond use of the vulnerable file-parsing functionality.

This is a genuine but moderately-scoped priority rather than a widespread emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a classic client-side file-parsing flaw: although PR:N means no pre-existing privileges are needed, AV:L combined with UI:R means the attacker cannot reach the target over a network and must convince an engineer to open a malicious file in ASDA-Soft locally. The exploitation-probability signals are low and mutually consistent: EPSS is 0.20% (9th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced in the input - so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is no SSVC decision data provided. The signals do not conflict: a high technical impact (full C/I/A compromise of the host via CWE-121 stack overflow) is tempered by the need for local access plus user interaction and the niche, operator-oriented deployment of the software. Net: patch on a normal cycle and prioritize for engineering workstations that handle untrusted project/configuration files, but this is not a mass-exploitation, internet-facing threat.

An attacker crafts a malicious ASDA-Soft project or configuration file and delivers it to a control-systems engineer via email, a shared drive, or a compromised vendor channel. When the engineer opens the file in ASDA-Soft, a stack-based buffer overflow (CWE-121) is triggered, allowing arbitrary code execution in the context of the logged-in user. No public proof-of-concept is referenced in the provided data.