CVE-2024-7502 is a high severity stack-based buffer overflow in Delta Electronics DIAScreen, the HMI screen editor. NVD scores it 7.8. A crafted DPA file can overflow the buffer and allow code execution. Delta fixed it in DIAScreen 1.4.2, so upgrade from anything older.
What's affected
According to the CISA ICS advisory ICSA-24-219-01, all DIAScreen versions prior to 1.4.2 are affected. Delta Electronics released version 1.4.2 and recommends installing it on all affected systems.
The record lists the weakness as CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write).
On severity, the sources give two numbers for the same flaw. The NVD record carries CVSS v3.1 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CISA advisory also lists a CVSS v4.0 score of 8.5. Both land in the high band.
How to check if you're exposed
DIAScreen is desktop software, so there is no package manager query that covers it. Work through these steps instead.
- Open DIAScreen on each engineering workstation and read the version from the About dialog.
- Ask automation and OT engineers whether anyone keeps a personal install on a laptop or a virtual machine. Engineering tools often live outside the asset register.
- Compare each version with 1.4.2. Anything lower is affected.
- Check where DPA project files come from. Files from vendors, integrators, shared drives or email are the realistic path to this bug.
If DIAScreen or its installer is bundled in a larger toolchain image, a dependency and software inventory scan helps you find it. The free in-browser scan at gold.safeguard.sh/scan covers package manifests, though desktop installers still need a manual look.
What to do now
- Upgrade every DIAScreen install to version 1.4.2 or later, using the Delta Electronics download source.
- Until then, open DPA files only from sources you trust and have verified.
- Keep engineering workstations off the internet and behind firewalls, away from business networks, as CISA advises for control system devices.
- Use a current VPN for remote access, and remember CISA's note that a VPN is only as secure as the devices connected to it.
- Run an impact analysis and risk assessment before you roll out any defensive change on a production network.
Why it matters
The cause is a memory safety mistake. DIAScreen reads a DPA file and copies data into a fixed-size buffer on the stack without enough length checking. A file built to be larger than expected writes past the buffer and can overwrite control data, which is how code execution becomes possible.
The exposure is narrower than the score might suggest. The vector is local with user interaction, and CISA states the vulnerability is not exploitable remotely. The user has to open the file. CISA also reports it has received no reports of known public exploitation targeting this flaw, and the record's KEV flag is false.
Still, engineering workstations are valuable targets because they hold project files for the machines on the plant floor. A file sent to an engineer is a plausible delivery route, so patching the editor is cheap insurance.
Quick check
Can this be exploited over the network on its own?
No. CISA says the vulnerability is not exploitable remotely. The vector is local and needs a user to open a crafted DPA file.
Which DIAScreen version fixes it?
Version 1.4.2. Everything before it is listed as affected in the CISA advisory.
Sources
Last reviewed: 19 October 2026.
