ZDI-24-636: Delta Electronics CNCSoft-G2 DOPSoft DPAX File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Jun 12, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-4192.

Affected Software

1 affected component

Delta Electronics CNCSoft-G2

Event History

Jun 12, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-24-636?

ZDI-24-636 has been assigned a critical severity rating due to its potential to allow remote code execution.

How do I fix ZDI-24-636?

To fix ZDI-24-636, ensure that you update to the latest version of Delta Electronics CNCSoft-G2 where the vulnerability has been addressed.

What types of systems are affected by ZDI-24-636?

ZDI-24-636 affects installations of Delta Electronics CNCSoft-G2 software.

What is required to exploit ZDI-24-636?

Exploitation of ZDI-24-636 requires user interaction, such as visiting a malicious website or opening a malicious file.

Are there any workarounds for ZDI-24-636?

Currently, the best workaround for ZDI-24-636 is to limit user access to untrusted sites and files until a patch is applied.