CVE-2024-4192 - Vulnerability Details - OpenCVE

Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Deltaww	Cncsoft-g2

Configuration 1 [-]

cpe:2.3:a:deltaww:cncsoft-g2:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-24-121-01

History

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00047}`	epss `{'score': 0.00071}`

Thu, 10 Jul 2025 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Deltaww Deltaww cncsoft-g2
CPEs		cpe:2.3:a:deltaww:cncsoft-g2::::::::
Vendors & Products		Deltaww Deltaww cncsoft-g2

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2024-04-30T23:01:58.874Z

Updated: 2024-09-03T18:16:25.046Z

Reserved: 2024-04-25T14:55:16.868Z

Link: CVE-2024-4192

Vulnrichment

Updated: 2024-08-01T20:33:52.537Z

NVD

Status : Analyzed

Published: 2024-04-30T23:15:06.770

Modified: 2025-07-10T15:54:18.440

Link: CVE-2024-4192

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4192", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-04-25T14:55:16.868Z", "datePublished": "2024-04-30T23:01:58.874Z", "dateUpdated": "2024-09-03T18:16:25.046Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CNCSoft-G2 DOPSoft", "vendor": "Delta Electronics", "versions": [{"lessThanOrEqual": "Versions 2.0.0.5 (with DOPSoft v5.0.0.93)", "status": "affected", "version": " 0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Natnael Samson working with Trend Micro Zero Day Initiative reported this vulnerability to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(241, 241, 242);\">Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.</span>\n\n"}], "value": "\nDelta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-04-30T23:01:58.874Z"}, "references": [{"tags": ["government-resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-121-01"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Delta Electronics recommends users update to </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&q=CNCSoft&sort_expr=cdate&sort_dir=DESC\">CNCSoft-G2 v2.1.0.4</a><span style=\"background-color: rgb(255, 255, 255);\"> or later.</span>\n\n<br>"}], "value": "\nDelta Electronics recommends users update to CNCSoft-G2 v2.1.0.4 https://downloadcenter.deltaww.com/en-US/DownloadCenter \u00a0or later.\n\n"}], "source": {"discovery": "UNKNOWN"}, "title": "Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 DOPSoft", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.537Z"}, "title": "CVE Program Container", "references": [{"tags": ["government-resource", "x_transferred"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-121-01"}]}, {"affected": [{"vendor": "delta_electronics", "product": "cncsoft-g2", "cpes": ["cpe:2.3:a:delta_electronics:cncsoft-g2:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.0.5", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-07T13:35:46.576164Z", "id": "CVE-2024-4192", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T18:16:25.046Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-121-01", "tags": ["government-resource", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.537Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-07T13:35:46.576164Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:delta_electronics:cncsoft-g2:*:*:*:*:*:*:*:*"], "vendor": "delta_electronics", "product": "cncsoft-g2", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.0.0.5"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T18:16:17.020Z"}}], "cna": {"title": "Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 DOPSoft", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Natnael Samson working with Trend Micro Zero Day Initiative reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Delta Electronics", "product": "CNCSoft-G2 DOPSoft", "versions": [{"status": "affected", "version": " 0", "versionType": "custom", "lessThanOrEqual": "Versions 2.0.0.5 (with DOPSoft v5.0.0.93)"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nDelta Electronics recommends users update to CNCSoft-G2 v2.1.0.4 https://downloadcenter.deltaww.com/en-US/DownloadCenter \u00a0or later.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Delta Electronics recommends users update to </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&q=CNCSoft&sort_expr=cdate&sort_dir=DESC\">CNCSoft-G2 v2.1.0.4</a><span style=\"background-color: rgb(255, 255, 255);\"> or later.</span>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-121-01", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nDelta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(241, 241, 242);\">Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-04-30T23:01:58.874Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4192", "state": "PUBLISHED", "dateUpdated": "2024-09-03T18:16:25.046Z", "dateReserved": "2024-04-25T14:55:16.868Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2024-04-30T23:01:58.874Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}