What is the CVSS score of CVE-2025-47728?

CVE-2025-47728 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Cncsoft G2 are affected by CVE-2025-47728?

CVE-2025-47728 affects Delta Electronics CNCSoft-G2 and enables authenticated local attackers to execute arbitrary code by crafting malicious files that execute with application-level privileges when…. A patch is available.

How to fix or mitigate CVE-2025-47728?

Within 24 hours: Identify all systems running Delta Electronics CNCSoft-G2 and document current versions. Within 7 days: Contact Delta Electronics for the specific patched version number and test in a non-production environment. Within 30 days: Deploy the vendor-released patch across all affected CNCSoft-G2 installations and verify successful application through version confirmation.

Cncsoft G2 CVE-2025-47728

EUVD-2025-16854 HIGH

Out-of-bounds Write (CWE-787)

2025-06-04 759f5e80-c8e1-4224-bead-956d7b33c98b

Information Disclosure Cncsoft G2

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.1.0.27

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16854

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

CVE Published

Jun 04, 2025 - 08:15 nvd

HIGH 7.3

DescriptionCVE.org

Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.

AnalysisAI

Local code execution vulnerability in Delta Electronics CNCSoft-G2 resulting from insufficient file validation when processing user-supplied files. An authenticated local attacker can craft a malicious file that, when opened by a user, executes arbitrary code with the privileges of the affected application. This vulnerability has a CVSS score of 7.3 (High) and requires local access and user interaction, making it a significant risk for organizations deploying CNCSoft-G2 in manufacturing or industrial control environments.

Technical ContextAI

CNCSoft-G2 is Delta Electronics' industrial control software, likely used for CNC machine programming and industrial automation. The vulnerability stems from CWE-787 (Out-of-bounds Write), indicating that the application fails to properly validate file structure and content before processing, potentially allowing buffer overflow or memory corruption attacks. The lack of input validation on file format/structure permits an attacker to write data outside intended memory boundaries when the application parses the malicious file. This is a classic unsafe file parsing vulnerability common in legacy industrial software that may lack modern memory safety protections. The vulnerability is triggered through the user opening a crafted file, suggesting it may affect CNCSoft-G2's file import/load functionality for project files, CAM files, or similar formats.

RemediationAI

PATCH: Apply the latest security update from Delta Electronics for CNCSoft-G2 (specific patch version/build number not provided; contact Delta support or check security advisory for exact version). 2) WORKAROUND (interim): Restrict file opening to trusted sources only; disable CNCSoft-G2 file auto-open features if available; run CNCSoft-G2 in a restricted user context rather than administrative account; implement file type restrictions via Windows Group Policy or equivalent. 3) DETECTION: Monitor for suspicious file access patterns, unexpected process spawning from CNCSoft-G2, or memory access violations in application logs. 4) OPERATIONAL: Educate users not to open CNCSoft-G2 project files from untrusted sources; implement file validation/sandboxing if available. Vendor advisory and patch details should be obtained directly from Delta Electronics security bulletins or their support portal.