EUVD-2025-16854
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
Analysis
Local code execution vulnerability in Delta Electronics CNCSoft-G2 resulting from insufficient file validation when processing user-supplied files. An authenticated local attacker can craft a malicious file that, when opened by a user, executes arbitrary code with the privileges of the affected application. This vulnerability has a CVSS score of 7.3 (High) and requires local access and user interaction, making it a significant risk for organizations deploying CNCSoft-G2 in manufacturing or industrial control environments.
Technical Context
CNCSoft-G2 is Delta Electronics' industrial control software, likely used for CNC machine programming and industrial automation. The vulnerability stems from CWE-787 (Out-of-bounds Write), indicating that the application fails to properly validate file structure and content before processing, potentially allowing buffer overflow or memory corruption attacks. The lack of input validation on file format/structure permits an attacker to write data outside intended memory boundaries when the application parses the malicious file. This is a classic unsafe file parsing vulnerability common in legacy industrial software that may lack modern memory safety protections. The vulnerability is triggered through the user opening a crafted file, suggesting it may affect CNCSoft-G2's file import/load functionality for project files, CAM files, or similar formats.
Affected Products
Delta Electronics CNCSoft-G2 (specific version not provided in description; likely multiple versions prior to a fix release). CPE string pattern would be: cpe:2.3:a:delta:cncsoft-g2:*:*:*:*:*:*:*:* (with version ranges to be determined from vendor advisory). Affected configurations include any Windows or applicable OS installations where CNCSoft-G2 is deployed with standard user privileges. Organizations should consult Delta Electronics official advisories for definitive affected version ranges and patch availability, which are not provided in the current data.
Remediation
1) PATCH: Apply the latest security update from Delta Electronics for CNCSoft-G2 (specific patch version/build number not provided; contact Delta support or check security advisory for exact version). 2) WORKAROUND (interim): Restrict file opening to trusted sources only; disable CNCSoft-G2 file auto-open features if available; run CNCSoft-G2 in a restricted user context rather than administrative account; implement file type restrictions via Windows Group Policy or equivalent. 3) DETECTION: Monitor for suspicious file access patterns, unexpected process spawning from CNCSoft-G2, or memory access violations in application logs. 4) OPERATIONAL: Educate users not to open CNCSoft-G2 project files from untrusted sources; implement file validation/sandboxing if available. Vendor advisory and patch details should be obtained directly from Delta Electronics security bulletins or their support portal.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today