Stack-based Buffer Overflow Vulnerability in Delta Electronics CNCSoft-G2
CVE-2024-47962

7.8HIGH

Key Information:

Vendor
Delta Electronics
Status
Cncsoft-g2
Vendor
CVE Published:
10 October 2024

Summary

The vulnerability in Delta Electronics CNCSoft-G2 arises from inadequate validation of user-supplied data length before it is copied to a fixed-length stack-based buffer. This flaw allows an attacker to potentially exploit the vulnerability by tricking an insider user into accessing a malicious web page or file. If successfully executed, this could lead to arbitrary code execution within the context of the application, posing significant risks to systems utilizing the affected software.

Affected Version(s)

CNCSoft-G2 2.1.0.10

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-2...
government-resource

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobby Gould, Fritz Sands, and Natnael Samson working with Trend Micro Zero Day Initiative reported these vulnerabilities to CISA.
.