EUVD-2025-16848Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 7.3 (High) with CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H indicates moderate-to-high exploitability in practice: Attack Vector Local (AV:L) and Access Complexity Low (AC:L) mean any local user can reliably exploit this; Privilege Level Low (PR:L) restricts to authenticated users; User Interaction Required (UI:R) necessitates social engineering or user action to open a file, reducing autonomous wormability; Scope Unchanged (S:U) and high impact ratings (C:H/I:H/A:H) show severe consequences if exploited. The lack of provided EPSS, KEV status, and POC information prevents definitive real-world prioritization. However, the local+low-complexity+low-privilege requirement combined with industrial software context suggests this is a credible insider threat or post-compromise lateral movement vector rather than a mass-exploitation risk. Organizations running CNCSoft in air-gapped or restricted-access environments face lower immediate risk; those with broader user access or external file ingestion face higher priority. |
| Exploit ScenarioDerived | An attacker with local system access or an insider threat crafts a malicious CNCSoft project file (.pro, .dat, or other CNCSoft file format) containing oversized or malformed data that triggers the buffer overflow in the file parser. The file is delivered to a CNCSoft operator via email, file share, or USB drive. When the operator opens the file in CNCSoft (satisfying the UI:R requirement), the parser reads the malicious data and writes it beyond the allocated buffer, overwriting adjacent heap or stack memory. This allows the attacker to redirect code execution flow to injected shellcode, resulting in arbitrary code execution with the privileges of the CNCSoft user. In an industrial setting, this could be leveraged to modify control logic, exfiltrate system configurations, or establish persistence. The local attack vector means this is particularly relevant in scenarios involving remote desktop access, shared workstations, or USB-based file transfer in air-gapped industrial networks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Buffer overflow vulnerability (CWE-787) in Delta Electronics CNCSoft that allows local authenticated users to execute arbitrary code by opening a specially crafted malicious file. The vulnerability requires user interaction (file opening) but results in complete compromise of the affected process with high impact to confidentiality, integrity, and availability. No KEV status, EPSS score, or confirmed active exploitation data is available in the provided intelligence.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper input validation in Delta Electronics CNCSoft's file parsing mechanism. CWE-787 (Out-of-bounds Write) indicates the application fails to properly validate the size or boundaries of user-supplied file content before writing to memory buffers. This is a classic buffer overflow condition where a maliciously crafted file with oversized data or malformed headers can cause the parser to write beyond allocated buffer boundaries. The affected product is Delta Electronics CNCSoft, a supervisory control and data acquisition (SCADA)/industrial control software suite. Without specific CPE data provided, the vulnerability likely affects CNCSoft across multiple versions, potentially CPE entries matching 'delta:cncsoft' or similar industrial software designations. The root cause is insufficient bounds checking during file deserialization or parsing operations.
Know when Cncsoft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
Executive ViewAI
CVE-2025-47726 is a high-severity code execution vulnerability affecting Delta Electronics CNCSoft that allows attackers to execute arbitrary code when users open malicious files. Organizations using CNCSoft face direct operational risk, particularly in industrial control and manufacturing environments where this software is deployed.
Within 24 hours: Inventory all systems running Delta Electronics CNCSoft and restrict file-opening capabilities to trusted sources only; notify users not to open files from untrusted origins. Within 7 days: Disable CNCSoft if operationally feasible, or implement application whitelisting and process monitoring on affected systems; contact Delta Electronics for patch availability and timeline. Within 30 days: Deploy vendor patch immediately upon release, or migrate to alternative software if patch remains unavailable.
Restrict CNCSoft file access to pre-vetted, trusted sources only; implement application whitelisting to prevent execution of unauthorized processes; deploy endpoint detection and response (EDR) tools to monitor CNCSoft process behavior; isolate CNCSoft systems on segmented networks with egress filtering; disable file-open functionality in CNCSoft if operationally possible; require mandatory user training on file-opening risks; implement file integrity monitoring on critical CNCSoft directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabili
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities could cau
CNCSoft: All versions prior to 1.01.32 does not properly sanitize input while processing a specific project file, allowi
Delta Electronics CNCSoft Versions 1.01.30 and prior are vulnerable to a stack-based buffer overflow, which may allow an
Local code execution vulnerability in Delta Electronics CNCSoft caused by insufficient validation of user-supplied files
Local arbitrary code execution vulnerability in Delta Electronics CNCSoft caused by insufficient validation of user-supp
Local privilege escalation vulnerability in Delta Electronics CNCSoft caused by insufficient validation of user-supplied
Delta Electronics CNCSoft (All versions prior to 1.01.32) does not properly sanitize input while processing a specific p
GitHub PoC
Exploit-DB