Cncsoft G2 CVE-2025-47728

CVSS score of 7.3 reflects High severity with important risk moderators: Attack Vector is Local (AV:L), meaning attacker must have local system access; Attack Complexity is Low (AC:L), indicating no special conditions required; Privilege Level is Low (PR:L), requiring a valid local user account but not administrative access; and User Interaction is Required (UI:R), necessitating the user to open a malicious file. The High impact on Confidentiality, Integrity, and Availability indicates potential for complete system compromise. However, real-world risk depends on deployment context: in isolated industrial environments with restricted file sharing, practical exploitation is lower; in organizations where files are frequently exchanged or where CNCSoft-G2 users have broader network access, risk escalates significantly. Without confirmed KEV (Known Exploited Vulnerability) status, EPSS score, or public POC availability mentioned in the provided data, this appears to be a standard high-priority vulnerability requiring timely patching but not an emergency zero-day scenario. The requirement for local access and user interaction substantially reduces the attack surface compared to network-based vulnerabilities, though it remains a valid vector for insider threats or supply chain compromises (malicious files distributed as templates or shared projects).

An attacker with local system access (or who can deliver a file to a local user) crafts a malicious CNCSoft-G2 project file with specially crafted data that violates the expected file format structure. When a CNCSoft-G2 user opens the file through the application's file dialog (File > Open or equivalent), the application's file parser fails to validate the file structure and attempts to process the malicious data. This triggers a buffer overflow or out-of-bounds write condition in memory, allowing the attacker's payload to overwrite critical function pointers, return addresses, or code sections. The attacker's shellcode executes in the context of the CNCSoft-G2 process, inheriting the privileges of the logged-in user. If the user is a domain user with access to network resources or sensitive manufacturing data, the attacker gains equivalent access. Example: A supplier sends a seemingly legitimate CNC program file (.NC, .ISO, or proprietary CNCSoft format) that actually contains a malformed file header; when the engineer opens it to review, code execution occurs silently in the background. No known public POC is indicated in the provided data, but the vulnerability is straightforward to weaponize once technical details become public.