ZDI-24-623: Delta Electronics CNCSoft-G2 DOPSoft DPAX File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Jun 12, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-4192.

Affected Software

1 affected component

Delta Electronics CNCSoft-G2

Event History

Jun 12, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-24-623?

ZDI-24-623 has been categorized with a critical severity level due to its potential for remote code execution.

How do I fix ZDI-24-623?

To mitigate ZDI-24-623, users should update to the latest version of Delta Electronics CNCSoft-G2 as recommended by the vendor.

What are the risks associated with ZDI-24-623?

The risks of ZDI-24-623 include remote code execution, which could allow attackers to take control of affected systems.

Does ZDI-24-623 require user interaction to be exploited?

Yes, ZDI-24-623 requires user interaction, such as visiting a malicious webpage or opening a harmful file, to be exploited.

Which software is affected by ZDI-24-623?

ZDI-24-623 affects installations of Delta Electronics CNCSoft-G2.