ASDA-Soft
CVE-2025-62580
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious ASDA-Soft file to engineer
-
DeliveryVictim opens file in ASDA-Soft
-
ExploitOverflow stack buffer in file parser
-
ExecutionExecute arbitrary code as current user
-
ImpactCompromise engineering workstation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that ASDA-Soft be installed on the target host and that a local user open an attacker-supplied malicious file (project/configuration file parsed by the application) - UI:R in the CVSS vector. There is no network-reachable component (AV:L), so an attacker must rely on social engineering or file delivery to the operator workstation. Limiting factors: the victim must actively open the crafted file, the software is deployed only on industrial/engineering workstations managing Delta servo drives, and impact is confined to the current user's context (S:U). No special in-application authentication is required (PR:N), but physical/logical access to deliver the file and an active user action are prerequisites. |
| Impact | This is a stack-based buffer overflow (CWE-121) in Delta Electronics' ASDA-Soft servo-drive configuration software. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a classic client-side file-parsing flaw: the attacker cannot reach the software over a network, but requires a victim to open a malicious project/configuration file (UI:R) on a system where ASDA-Soft is installed. PR:N means no authentication to the application is needed, but the local attack vector and required user interaction substantially limit real-world exploitability versus a remote-network bug of the same score. Exploitation signals are weak-to-absent: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so this is a high-CVSS, low-current-real-world-risk issue rather than an active threat. The signals are internally consistent (local, UI-dependent flaw with low EPSS and no KEV), so there is no conflict to flag; the main caveat is that the only reference is the Delta vendor advisory PDF, with no independent corroboration of fixed versions or exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious ASDA-Soft project or configuration file and delivers it to an engineer or operator (e.g., via email, USB, or a shared drive) who runs ASDA-Soft. When the victim opens the file, the parser overflows a stack buffer, allowing arbitrary code execution in the context of the logged-in user. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A stack-based buffer overflow in Delta Electronics ASDA-Soft, the configuration utility for ASDA series servo drives, allows memory corruption when a local user opens a crafted project or configuration file. Affected are ASDA-Soft installations on engineering workstations (the CPE wildcard cpe:2.3:a:deltaww:asda_soft:*:*:*:*:*:*:*:* indicates all versions are in scope); exploitation requires the victim to actively open an attacker-supplied file and yields code execution in the context of the current user, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:N/UI:R/S:U). No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.20% (9th percentile), though the reliance on file-delivery social engineering to operator workstations keeps the residual risk non-trivial in industrial environments.
RemediationAI
No vendor-released patch version is specified in the available data, so the first step is to consult Delta's advisory PCSA-2025-00019 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00019_ASDA-Soft%20Stack-based%20Buffer%20Overflow%20Vulnerabilities.pdf) to confirm whether a fixed ASDA-Soft build has been published and to apply it if so; patch availability and version are not independently confirmed here. Until a fix is deployed, the most effective control is to restrict the provenance of files the application opens: enforce a policy that project and configuration files are only loaded from trusted, internally controlled engineering repositories, and scan or block files received by email, USB media, or chat before they reach ASDA-Soft - this directly removes the UI:R precondition that the exploit depends on. Additionally, run ASDA-Soft under a least-privileged, non-administrative account and confine it to dedicated engineering workstations that are segmented from corporate networks, which limits the blast radius if memory corruption is successfully triggered; application allowlisting and disabling unnecessary file-association handling for ASDA project formats can further reduce the chance of accidental execution. The trade-off is operational friction - engineers lose the convenience of opening externally supplied project files, which should be routed through a validated central staging area instead - and no configuration change fully substitutes for a vendor patch, since the underlying buffer length check remains absent.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), meaning the software fails to validate the length of data copied into a fixed-size stack buffer, allowing adjacent memory such as saved return addresses or function pointers to be overwritten. In ASDA-Soft this occurs while parsing an attacker-crafted project or configuration file, a format the application consumes as part of normal servo-drive commissioning and tuning workflows. Because the overflow is triggered during file parsing on the local host rather than over a network service, the CVSS vector is AV:L with UI:R - the attacker must deliver the file and persuade the operator to open it. The S:U scope and PR:N indicate no privilege escalation barrier inside the application: the corrupted memory is exploited within the privileges of the user who opens the file, so impact is bounded by that account but can still include code execution, data theft, and tampering with drive configuration. The CPE identifier confirms Delta Electronics (deltaww) ASDA-Soft as the sole affected component, and the included reference points to Delta's own Product Security Advisory PCSA-2025-00019, indicating the vendor has acknowledged and documented the issue.
Know when Asda Soft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parsing overflow needs no app authentication (PR:N) but requires the user to open a crafted file (UI:R, AV:L); code execution yields full C/I/A impact in the user context.
Primary rating from Vendor (759f5e80-c8e1-4224-bead-956d7b33c98b).
CVSS VectorVendor: 759f5e80-c8e1-4224-bead-956d7b33c98b
DescriptionCVE.org
ASDA-Soft Stack-based Buffer Overflow Vulnerability
Executive ViewAI
Delta Electronics ASDA-Soft, used to configure ASDA series servo drives, contains a high-severity stack-based buffer overflow that can allow code execution on engineering workstations when a user opens a crafted project or configuration file. This affects engineering and maintenance staff who use the tool to manage industrial servo systems, and a successful compromise could disrupt production, alter drive settings, or lead to safety and reliability issues. While no public exploit identified at time of analysis, the lack of a vendor patch and reliance on file-delivery social engineering warrant management attention to reduce risk in OT environments.
No vendor-released patch identified at time of analysis; interim mitigations include restricting ASDA-Soft project/config file opening to trusted sources, enforcing application allowlisting and least privilege on engineering workstations, segmenting OT workstations, filtering email/web/USB file transfers, and training operators to recognize social engineering.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Affected Products (CPE)CVE.org
Stack-based buffer overflow in Delta Electronics ASDA-Soft allows local attackers with no privileges to execute arbitrar
Stack-based buffer overflow in Delta Electronics' ASDA-Soft servo commissioning software can be triggered when a user op
ASDA-Soft Stack-based Buffer Overflow Vulnerability [CVSS 7.8 HIGH]
ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing
ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing
GitHub PoC
Exploit-DB