CVE-2023-5131 is a high severity (CVSS 8.2) heap buffer overflow in Delta Electronics ISPSoft. Opening a specially crafted DVP file can lead to code execution. Exodus Intelligence says the product is end of life and no patches are available, so control which files are opened and plan to migrate.
What's affected
The NVD record says a heap buffer overflow exists in Delta Electronics ISPSoft, and that an anonymous attacker can exploit it by enticing a user to open a specially crafted DVP file to achieve code execution.
Exodus Intelligence published its advisory on 18 January 2024. It says the vendor was told on 8 March 2023 and replied on 22 March 2023, and that the affected product is end of life with no patches available. As a result, there is no fixed version in the sources we read.
Exodus also lists a CVSS version 2 score of 7.3, while NVD gives 8.2 under CVSS 3. These are two scales for the same bug. The sibling issue CVE-2023-5130 in WPLSoft has the same shape, and teams that use one tool often use the other.
How to check if you're exposed
Search your engineering workstations for ISPSoft. It is programming software for Delta PLCs, so it lives on laptops and PCs used by controls engineers and integrators.
Trace how DVP files reach those machines. Files from vendors, contractors and email are the common risks.
Check network paths from those machines to controllers. The closer the workstation is to production equipment, the more important isolation becomes.
Make sure the same checks cover WPLSoft, since the file format is shared.
What to do now
- Build a list of ISPSoft installs and owners.
- Open DVP files from outside the team only in an isolated virtual machine.
- Segment engineering workstations from office and internet networks.
- Use allow listing, and keep the operating system and endpoint tools up to date.
- Plan migration to a supported tool, because no patch is coming.
Why it matters
The record lists CWE-119, CWE-787, memory safety classes covering improper restriction of operations within a memory buffer and an out of bounds write. The software reads a project file and copies data based on values the file itself supplies.
Memory bugs in file parsers are common in engineering tools that were built for trusted inputs. Today those files travel by email and shared drives. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. For end of life software, the only real fix is a controlled environment and a migration plan.
Quick check
Why is the score the same as the WPLSoft issue?
Both are file based overflows that give code execution when a user opens a crafted DVP file, and both score 8.2 under CVSS 3.
Sources
Last reviewed: 19 October 2026.
