Delta Electronics COMMGR stack overflow and code injection
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Two remotely-exploitable flaws in Delta COMMGR up to v2.9.0 allow arbitrary code execution; update to v2.10.0.
Delta Electronics COMMGR, a control system management product deployed worldwide in critical manufacturing, contains two high-severity vulnerabilities enabling remote code execution. CVE-2025-53418 is a stack-based buffer overflow (CVSS 8.8) triggered by specially crafted .isp files that requires no user interaction and can be exploited remotely with low complexity. CVE-2025-53419 is a code injection flaw (CVSS 8.4) in the same product, also exploitable via malicious .isp files, though this variant requires local access and user interaction. Both affect all versions up to and including v2.9.0. Delta has released version v2.10.0 as a fix. CISA reports no active public exploitation of these vulnerabilities as of publication, but the low barrier to remote exploitation of CVE-2025-53418 and the product's deployment in critical manufacturing infrastructure create significant risk. Defenders should prioritize patching and restrict network access to COMMGR systems.
Mentioned in this report
Detection guidance
Delta COMMGR Spawning Command Shell or Scripting Interpreter
COMMGR.exe spawning a shell, script host or LOLBin, which is consistent with exploitation of a crafted .isp file (CVE-2025-53418/53419). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Delta COMMGR Spawning Command Shell or Scripting Interpreter
description: Detects the Delta Electronics COMMGR process spawning a command shell,
scripting host or common LOLBin. This suggests code execution after a crafted .isp
file triggered a stack overflow or code injection (CVE-2025-53418, CVE-2025-53419).
Assumes the process image is named COMMGR.exe.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \COMMGR.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \curl.exe
condition: selection
falsepositives:
- Vendor-supplied COMMGR scripts or helper batch files that legitimately call cmd.exe
during configuration
level: high
id: 3564a5a7-0181-5fb0-b3b4-cf91e50650b8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-05
Delta COMMGR Loading DLL From User-Writable Path
COMMGR.exe loading a DLL from a user-writable location, which may indicate code injection or module hijacking through a malicious .isp file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Delta COMMGR Loading DLL From User-Writable Path
description: Detects COMMGR.exe loading a DLL from a user-writable directory such
as Temp, AppData, Downloads, Public or ProgramData. This may indicate the code injection
or shared-module loading described for CVE-2025-53419 after a malicious .isp file
is opened. Assumes the process image is named COMMGR.exe.
tags:
- attack.execution
- attack.t1129
- attack.t1203
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith: \COMMGR.exe
ImageLoaded|endswith: .dll
ImageLoaded|contains:
- \AppData\
- \Temp\
- \Downloads\
- \Users\Public\
- \ProgramData\
condition: selection
falsepositives:
- Per-user installs of COMMGR that keep legitimate plugin DLLs under AppData
level: medium
id: 1ee19dac-a066-5089-be5e-e39a01b2b8de
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-05
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-05
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs