This vulnerability is a stack-based buffer overflow in ASDA-Soft that can allow an attacker to corrupt the call stack and execute arbitrary code. The flaw is a classic stack corruption bug, as identified by CWE-121 and CWE-787. If successfully exploited, the attacker could gain local or higher privileges on the affected system, potentially impacting confidentiality, integrity, or availability of the device.

Delta Electronics’ ASDA-Soft products are affected. No specific product versions are listed in the CNA data; however, the official solution recommends upgrading to version 7.2.2.0 or later. The affected devices likely include industrial control systems that run ASDA-Soft firmware.

The CVSS vector indicates a score of 7.8, reflecting a high severity. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is very low, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is not explicitly described, so the likely attack vector is inferred to be local or remote via a privileged interface of the ASDA-Soft software, unless the device is isolated. The combination of a high CVSS score and low EPSS score places this issue in a moderate risk category, requiring a patch but posing limited immediate threat to broadly exposed systems.