No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
Credit: Bobby Gould, Fritz Sands, Natnael Samson (Trend Micro Zero Day Initiative)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-47962 | CWE-121 Stack-based Buffer Overflow | 7.8 High |
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can manipulate an insider to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process. Vendor fix: Delta Electronics recommends users update to CNCSoft-G2 v2.1.0.16 or later. ↗ Mitigation: CISA recommends users take the following measures to protect themselves from social engineering attacks: Mitigation: Do not click web links or open attachments in unsolicited email messages. Affected, fixed & timelineAffected:
Mitigation: Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Mitigation: Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. |
| CVE-2024-47963 | CWE-787 Out-of-bounds Write | 7.8 High |
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process. Vendor fix: Delta Electronics recommends users update to CNCSoft-G2 v2.1.0.16 or later. ↗ Mitigation: CISA recommends users take the following measures to protect themselves from social engineering attacks: Mitigation: Do not click web links or open attachments in unsolicited email messages. Affected, fixed & timelineAffected:
Mitigation: Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Mitigation: Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. |
| CVE-2024-47964 | CWE-122 Heap-based Buffer Overflow | 7.8 High |
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process. Vendor fix: Delta Electronics recommends users update to CNCSoft-G2 v2.1.0.16 or later. ↗ Mitigation: CISA recommends users take the following measures to protect themselves from social engineering attacks: Mitigation: Do not click web links or open attachments in unsolicited email messages. Affected, fixed & timelineAffected:
Mitigation: Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Mitigation: Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. |
| CVE-2024-47965 | CWE-125 Out-of-bounds Read | 7.8 High |
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process. Vendor fix: Delta Electronics recommends users update to CNCSoft-G2 v2.1.0.16 or later. ↗ Mitigation: CISA recommends users take the following measures to protect themselves from social engineering attacks: Mitigation: Do not click web links or open attachments in unsolicited email messages. Affected, fixed & timelineAffected:
Mitigation: Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Mitigation: Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. |
| CVE-2024-47966 | CWE-457 Use of Uninitialized Variable | 7.8 High |
Delta Electronics CNCSoft-G2 lacks proper initialization of memory prior to accessing it. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process. Vendor fix: Delta Electronics recommends users update to CNCSoft-G2 v2.1.0.16 or later. ↗ Mitigation: CISA recommends users take the following measures to protect themselves from social engineering attacks: Mitigation: Do not click web links or open attachments in unsolicited email messages. Affected, fixed & timelineAffected:
Mitigation: Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Mitigation: Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-47962 | 8.4 High | Delta Electronics CNCSoft-G2 Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An… |
| CVE-2024-47963 | 8.4 High | Delta Electronics CNCSoft-G2 Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attac… |
| CVE-2024-47964 | 8.4 High | Delta Electronics CNCSoft-G2 Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An … |
| CVE-2024-47965 | 8.4 High | Delta Electronics CNCSoft-G2 Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attack… |
| CVE-2024-47966 | 8.4 High | Delta Electronics CNCSoft-G2 Delta Electronics CNCSoft-G2 lacks proper initialization of memory prior to accessing it. An attacker can manipulate users to visit a malicious page … |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.