CVE-2023-5130 is a high severity (CVSS 8.2) buffer overflow in Delta Electronics WPLSoft. Opening a specially crafted DVP file can lead to code execution. Exodus Intelligence says the product is end of life and no patches are available, so limit who can open project files and plan to migrate.
What's affected
The NVD record says a buffer overflow vulnerability exists in Delta Electronics WPLSoft, and that an anonymous attacker can exploit it by enticing a user to open a specially crafted DVP file, which can achieve code execution.
The Exodus Intelligence advisory, published on 18 January 2024, says the vendor was told on 8 March 2023 and responded on 22 March 2023. Under vendor references it states that the affected product is end of life and no patches are available. So there is no fixed version to point to, and the advice has to be about reducing exposure.
Severity differs by scale. NVD gives 8.2 using CVSS 3. Exodus lists a CVSS version 2 score of 7.3 for the same issue. They are different scoring systems rather than a real disagreement.
How to check if you're exposed
Find where WPLSoft is installed. It is engineering software for programming Delta PLCs, so look at engineering workstations, laptops that service technicians use, and any shared project servers.
Identify how DVP project files arrive. Email, file shares, USB sticks and vendor support portals are the common routes.
Check whether the workstations that run WPLSoft are on a network with access to production controllers. A compromised engineering laptop is the more serious case.
Record which people have the tool, and whether it still has an active use.
What to do now
- Inventory WPLSoft installs and the people who use them.
- Treat DVP files from outside your team as untrusted, and open them only on an isolated machine.
- Keep engineering workstations off the general office network, and limit what they can reach.
- Apply application allow listing and endpoint protection on those machines.
- Plan the move to a supported programming tool, since there is no patch.
Why it matters
The record lists CWE-119, CWE-120, both memory safety classes: improper restriction of operations within a memory buffer, and a classic buffer copy without checking input size. A parser reads a file and trusts a length inside it, so a crafted file can overwrite memory.
The attack needs a user to open a file, so it relies on social engineering or a poisoned share. Industrial engineering tools are valuable targets because they sit next to controllers. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. With no patch, controls around the workstation are the defence.
Quick check
Is there a patch?
Exodus Intelligence says the product is end of life and no patches are available. Mitigate by controlling files and isolating the workstation, and plan to migrate.
Sources
Last reviewed: 19 October 2026.
