ZDI-CAN-27323: ZDI-25-985: Delta Electronics CNCSoft-G2 DOPSoft DPAX File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Nov 10, 2025

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-47728.

Affected Software

1 affected component

Delta Electronics CNCSoft-G2

Event History

Nov 10, 2025

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-27323?

The severity of ZDI-CAN-27323 is classified as critical due to its potential to allow remote code execution.

How do I fix ZDI-CAN-27323?

To fix ZDI-CAN-27323, ensure that you apply the latest security updates provided by Delta Electronics for CNCSoft-G2.

What products are affected by ZDI-CAN-27323?

ZDI-CAN-27323 affects the Delta Electronics CNCSoft-G2 software.

Is user interaction required to exploit ZDI-CAN-27323?

Yes, user interaction is required as the target must visit a malicious page or open a malicious file to exploit ZDI-CAN-27323.

What type of vulnerability is ZDI-CAN-27323?

ZDI-CAN-27323 is a remote code execution vulnerability.