# Delta DTM Soft deserialization flaw allows local file encryption

Published: 2025-07-10 · Severity: elevated · Sectors: manufacturing
Canonical: https://vorant.io/reports/272139d5-c6f4-59dc-b809-308d90b6fd35/delta-dtm-soft-deserialization-flaw-allows-local-file-encryption

> Delta DTM Soft versions 1.6.0.0 and earlier contain a deserialization flaw enabling local attackers to encrypt files and extract information.

Delta Electronics DTM Soft is vulnerable to CWE-502 deserialization of untrusted data (CVE-2025-53415), affecting versions 1.6.0.0 and prior. The vulnerability requires local access and user interaction to exploit, allowing an attacker to encrypt files associated with the application and extract sensitive information. CVSS v4 base score is 8.4 with low attack complexity. The vulnerability is not remotely exploitable. No public exploitation has been reported as of the advisory date. Delta has released a patched version and recommends immediate update. The vulnerability affects critical manufacturing infrastructure worldwide, with the vendor headquartered in Taiwan. Researchers from Trend Micro Zero Day Initiative reported the flaw. Defenders should update to the latest DTM Soft version, isolate control system networks from the internet, restrict network access, and employ VPNs for required remote access.

## Mentioned in this report

- Vulnerabilities: CVE-2025-53415

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-07

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/272139d5-c6f4-59dc-b809-308d90b6fd35/delta-dtm-soft-deserialization-flaw-allows-local-file-encryption.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup