CVE-2024-4192
Assigner: icscert
Published: 2024-04-30T23:01:58.874Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: CNCSoft-G2 DOPSoft
vendor: Delta Electronics
versions: lessThanOrEqual: Versions 2.0.0.5 (with DOPSoft v5.0.0.93)
status: affected
version:  0
versionType: custom
credits: type: finder
value: Natnael Samson working with Trend Micro Zero Day Initiative reported this vulnerability to CISA.
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(241, 241, 242);">Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.</span>


value: 
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-121
description: CWE-121 Stack-based Buffer Overflow
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Delta Electronics recommends users update to </span><a target="_blank" rel="nofollow" href="https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&amp;q=CNCSoft&amp;sort_expr=cdate&amp;sort_dir=DESC">CNCSoft-G2 v2.1.0.4</a><span style="background-color: rgb(255, 255, 255);">&nbsp;or later.</span>

<br>
value: 
Delta Electronics recommends users update to  CNCSoft-G2 v2.1.0.4 https://downloadcenter.deltaww.com/en-US/DownloadCenter  or later.


source: discovery: UNKNOWN
title: Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 DOPSoft
x_generator: engine: Vulnogram 0.1.0-dev