CVE-2024-12835: Delta Electronics DRASimuCAD RCE Vulnerability

CVE-2024-12835 is a remote code execution vulnerability in Delta Electronics DRASimuCAD caused by improper ICS file parsing. Attackers can exploit this flaw to execute arbitrary code when users open malicious files. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-12835 Overview

CVE-2024-12835 is an out-of-bounds write vulnerability [CWE-787] in Delta Electronics DRASimuCAD. The flaw resides in the parsing logic for ICS files. Attackers can exploit it to execute arbitrary code in the context of the current process. Exploitation requires user interaction: the target must open a crafted ICS file or visit a malicious page delivering one. The Zero Day Initiative tracked this issue as ZDI-CAN-22415 and published advisory ZDI-24-1723.

Critical Impact
Successful exploitation grants arbitrary code execution on the workstation running DRASimuCAD, providing a foothold into industrial control system engineering environments.

Affected Products

Delta Electronics DRASimuCAD (all versions listed under cpe:2.3:a:deltaww:drasimucad:*)
Windows workstations used for ICS robot simulation and design
Engineering hosts that process third-party or externally sourced ICS files

Discovery Timeline

2024-12-30 - CVE-2024-12835 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12835

Vulnerability Analysis

DRASimuCAD is an industrial robotics simulation and CAD environment from Delta Electronics. The affected component parses ICS files without properly validating user-supplied data. When a malformed field is processed, the routine writes past the end of an allocated buffer. This out-of-bounds write corrupts adjacent memory structures and can be shaped to redirect execution.

Because exploitation is local and requires user interaction, attackers typically deliver malicious ICS files through phishing, watering-hole downloads, or shared engineering repositories. The exploited process runs with the privileges of the interactive user, which on many engineering workstations includes elevated rights over ICS project files and adjacent OT assets.

No public proof-of-concept exploit is documented, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing bounds checking during deserialization of ICS file records. The parser trusts length or offset values embedded in the file and uses them to index into a fixed-size buffer. A crafted record extends the write beyond the allocation, overwriting heap or stack metadata depending on the buffer's storage class.

Attack Vector

The attack vector is local and file-based. An attacker crafts an ICS file that triggers the out-of-bounds write during parsing. Delivery paths include email attachments, malicious project bundles shared between engineers, and compromised software distribution channels. When the operator opens the file in DRASimuCAD, the parser reaches the malformed structure and the write executes attacker-controlled memory corruption.

The vulnerability manifests during ICS file parsing. Refer to the Zero Day Initiative Advisory ZDI-24-1723 for technical details on the affected parsing routine.

Detection Methods for CVE-2024-12835

Indicators of Compromise

Unexpected child processes spawned by the DRASimuCAD executable shortly after opening an .ics file
ICS files arriving via email, chat, or removable media from unverified senders on engineering workstations
Crash dumps or Windows Error Reporting entries referencing DRASimuCAD modules with access violations on write operations
Outbound network connections from the DRASimuCAD process to non-Delta infrastructure

Detection Strategies

Monitor process lineage for DRASimuCAD spawning cmd.exe, powershell.exe, or scripting hosts
Alert on write-access violations and heap corruption exceptions within the DRASimuCAD process
Inspect ICS files at the email gateway and file share layer for anomalous size, structure, or embedded payloads

Monitoring Recommendations

Enable command-line and module-load logging on engineering workstations running DRASimuCAD
Forward endpoint telemetry from OT engineering hosts to a central data lake for retrospective hunting
Track file-open events for ICS extensions and correlate with subsequent process, network, and file-write activity

How to Mitigate CVE-2024-12835

Immediate Actions Required

Restrict opening of ICS files in DRASimuCAD to files originating from trusted, verified sources
Isolate DRASimuCAD engineering workstations from general-purpose email and browsing where feasible
Enforce least privilege so DRASimuCAD runs under a standard user account, not a local administrator
Apply application allowlisting to prevent unauthorized child processes from executing

Patch Information

No vendor advisory URL is listed in the enriched data. Consult Delta Electronics product security channels and the Zero Day Initiative Advisory ZDI-24-1723 for current remediation guidance and fixed versions.

Workarounds

Block inbound ICS files at email and web gateways until a vendor fix is deployed
Open untrusted ICS files only inside isolated virtual machines with no OT network access
Disable file associations that automatically launch DRASimuCAD when an ICS file is opened
Segment engineering workstations from production OT networks to contain post-exploitation movement

bash

# Example: block .ics attachments at a Windows file share via File Server Resource Manager
New-FsrmFileGroup -Name "BlockedICS" -IncludePattern @("*.ics")
New-FsrmFileScreen -Path "E:\Engineering\Inbox" -IncludeGroup "BlockedICS" -Active $true