CVE-2020-16203: Delta Industrial Automation CNCSoft ScreenEditor DPB File Parsing Uninitialized Pointer Dereference Remote Code Execution Vulnerability
Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash the application.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation CNCSoft ScreenEditor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DPB files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-16203?
CVE-2020-16203 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation CNCSoft ScreenEditor.
How can an attacker exploit CVE-2020-16203?
To exploit CVE-2020-16203, the attacker would need the target to visit a malicious page or open a malicious file.
What is the severity of CVE-2020-16203?
The severity of CVE-2020-16203 is high, with a CVSS score of 7.8.
Which software versions are affected by CVE-2020-16203?
The software version affected by CVE-2020-16203 is Delta Industrial Automation CNCSoft ScreenEditor up to version 1.01.23.
Where can I find more information about CVE-2020-16203?
More information about CVE-2020-16203 can be found at the following references: [US-CERT Advisory](https://us-cert.cisa.gov/ics/advisories/icsa-20-217-01), [ZDI Advisory](https://www.zerodayinitiative.com/advisories/ZDI-20-948/).