Skip to content
OpenAdvisories
High ICSA-24-191-01 5 CVEs

Delta Electronics CNCSoft-G2 (Update A)

Published Jul 9, 2024 · Updated Feb 18, 2025 · Revision 2

Vendor: Delta Electronics Product: CNCSoft-G2

Summary

Successful exploitation of these vulnerabilities could cause a buffer overflow condition and allow remote code execution.

Vulnerabilities 5

  • High 8.4
    CVE-2024-39881

    Out-of-bounds Write in Delta Electronics CNCSoft-G2

    Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the con…

    Delta Electronics CNCSoft-G2 ICS / OT
  • High 8.4
    CVE-2024-39882

    Out-of-bounds Read in Delta Electronics CNCSoft-G2

    Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute co…

    Delta Electronics CNCSoft-G2 ICS / OT
  • High 8.4
    CVE-2024-39883

    Heap-based Buffer Overflow in Delta Electronics CNCSoft-G2

    Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to exec…

    Delta Electronics CNCSoft-G2 ICS / OT
  • High 7.8
    CVE-2024-39880

    Stack-based Buffer Overflow in Delta Electronics CNCSoft-G2

    Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to exe…

    Delta Electronics CNCSoft-G2 ICS / OT
  • High 7.8
    CVE-2025-22880

    Heap-based Buffer Overflow in CNCSoft-G2

    Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to exec…

    Delta Electronics CNCSoft-G2 ICS / OT

Revision history

  1. #2

    Update A - Updated the Mitigations section to include the fixed version to mitigate CVE-2025-22880.

  2. #1

    Initial Publication

References