EUVD-2025-16849CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
AnalysisAI
Local arbitrary code execution vulnerability in Delta Electronics CNCSoft caused by insufficient validation of user-supplied files. An attacker with local access can craft a malicious file that, when opened by a user, executes arbitrary code with the privileges of the CNCSoft process. With a CVSS score of 7.3 and CWE-787 (Out-of-bounds Write) classification, this represents a significant local privilege escalation risk, though exploitation requires user interaction and local access.
Technical ContextAI
CVE-2025-47725 stems from CWE-787 (Out-of-bounds Write), a memory safety vulnerability where CNCSoft fails to properly validate the structure and boundaries of user-supplied file inputs. Delta Electronics CNCSoft is industrial automation software used for CNC machine control and programming. The vulnerability likely exists in the file parsing routines that handle project files, CAM files, or other CNCSoft-native formats without adequate bounds checking or input sanitization. When a malformed file is processed, an attacker can write data beyond allocated buffer boundaries, corrupting memory and achieving code execution within the application context. The affected software operates on Windows systems and is commonly deployed in manufacturing environments where file sharing and batch processing are standard practices.
RemediationAI
- Apply vendor-provided security patch from Delta Electronics immediately upon release. 2) Until patching is possible, implement compensating controls: restrict CNCSoft file access to trusted sources only; disable auto-opening of CNCSoft project files from email and network shares; operate CNCSoft with least-privilege user accounts; implement file integrity monitoring on CNCSoft project directories; restrict user ability to open files from network locations. 3) Monitor vendor advisory page (Delta Electronics Security Center) for patch availability and release notes. 4) If patch is available, deploy to all affected systems according to change management procedures, testing in non-production environment first given the industrial control context.
Share
External POC / Exploit Code
Leaving vuln.today