# Delta Electronics COMMGR stack overflow and code injection

Published: 2025-08-28 · Severity: routine · Sectors: manufacturing
Canonical: https://vorant.io/reports/9eb2197e-757a-5e16-8c2e-b0197b3853ec/delta-electronics-commgr-stack-overflow-and-code-injection

> Two remotely-exploitable flaws in Delta COMMGR up to v2.9.0 allow arbitrary code execution; update to v2.10.0.

Delta Electronics COMMGR, a control system management product deployed worldwide in critical manufacturing, contains two high-severity vulnerabilities enabling remote code execution. CVE-2025-53418 is a stack-based buffer overflow (CVSS 8.8) triggered by specially crafted .isp files that requires no user interaction and can be exploited remotely with low complexity. CVE-2025-53419 is a code injection flaw (CVSS 8.4) in the same product, also exploitable via malicious .isp files, though this variant requires local access and user interaction. Both affect all versions up to and including v2.9.0. Delta has released version v2.10.0 as a fix. CISA reports no active public exploitation of these vulnerabilities as of publication, but the low barrier to remote exploitation of CVE-2025-53418 and the product's deployment in critical manufacturing infrastructure create significant risk. Defenders should prioritize patching and restrict network access to COMMGR systems.

## Mentioned in this report

- Vulnerabilities: CVE-2025-53418, CVE-2025-53419

## Detection guidance (public sample)

### Delta COMMGR Spawning Command Shell or Scripting Interpreter

ATT&CK: T1203

COMMGR.exe spawning a shell, script host or LOLBin, which is consistent with exploitation of a crafted .isp file (CVE-2025-53418/53419). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Delta COMMGR Spawning Command Shell or Scripting Interpreter
description: Detects the Delta Electronics COMMGR process spawning a command shell,
  scripting host or common LOLBin. This suggests code execution after a crafted .isp
  file triggered a stack overflow or code injection (CVE-2025-53418, CVE-2025-53419).
  Assumes the process image is named COMMGR.exe.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \COMMGR.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
  condition: selection
falsepositives:
- Vendor-supplied COMMGR scripts or helper batch files that legitimately call cmd.exe
  during configuration
level: high
id: 3564a5a7-0181-5fb0-b3b4-cf91e50650b8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-05
```

### Delta COMMGR Loading DLL From User-Writable Path

ATT&CK: T1129

COMMGR.exe loading a DLL from a user-writable location, which may indicate code injection or module hijacking through a malicious .isp file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Delta COMMGR Loading DLL From User-Writable Path
description: Detects COMMGR.exe loading a DLL from a user-writable directory such
  as Temp, AppData, Downloads, Public or ProgramData. This may indicate the code injection
  or shared-module loading described for CVE-2025-53419 after a malicious .isp file
  is opened. Assumes the process image is named COMMGR.exe.
tags:
- attack.execution
- attack.t1129
- attack.t1203
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \COMMGR.exe
    ImageLoaded|endswith: .dll
    ImageLoaded|contains:
    - \AppData\
    - \Temp\
    - \Downloads\
    - \Users\Public\
    - \ProgramData\
  condition: selection
falsepositives:
- Per-user installs of COMMGR that keep legitimate plugin DLLs under AppData
level: medium
id: 1ee19dac-a066-5089-be5e-e39a01b2b8de
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-05
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-05

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9eb2197e-757a-5e16-8c2e-b0197b3853ec/delta-electronics-commgr-stack-overflow-and-code-injection.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup