Delta Industrial Automation CNCSoft/CNCSoft ScreenEditor up to 1.00.84 Project File out-of-bounds

Summaryinfo

A vulnerability has been found in Delta Industrial Automation CNCSoft and CNCSoft ScreenEditor up to 1.00.84 and classified as critical. The impacted element is an unknown function. This manipulation as part of Project File causes out-of-bounds. This vulnerability is handled as CVE-2019-6547. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability was found in Delta Industrial Automation CNCSoft and CNCSoft ScreenEditor up to 1.00.84 (Automation Software). It has been declared as critical. Affected by this vulnerability is an unknown part. The manipulation as part of a Project File leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability may cause the software to crash due to lacking user input validation for processing project files.

The bug was discovered 02/19/2019. The weakness was released 02/28/2019 (Website). The advisory is shared at securityfocus.com. This vulnerability is known as CVE-2019-6547 since 01/22/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 9 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• Delta Industrial Automation

Name

• CNCSoft
• CNCSoft ScreenEditor

Version

• 1.00.0
• 1.00.1
• 1.00.2
• 1.00.3
• 1.00.4
• 1.00.5
• 1.00.6
• 1.00.7
• 1.00.8
• 1.00.9
• 1.00.10
• 1.00.11
• 1.00.12
• 1.00.13
• 1.00.14
• 1.00.15
• 1.00.16
• 1.00.17
• 1.00.18
• 1.00.19
• 1.00.20
• 1.00.21
• 1.00.22
• 1.00.23
• 1.00.24
• 1.00.25
• 1.00.26
• 1.00.27
• 1.00.28
• 1.00.29
• 1.00.30
• 1.00.31
• 1.00.32
• 1.00.33
• 1.00.34
• 1.00.35
• 1.00.36
• 1.00.37
• 1.00.38
• 1.00.39
• 1.00.40
• 1.00.41
• 1.00.42
• 1.00.43
• 1.00.44
• 1.00.45
• 1.00.46
• 1.00.47
• 1.00.48
• 1.00.49
• 1.00.50
• 1.00.51
• 1.00.52
• 1.00.53
• 1.00.54
• 1.00.55
• 1.00.56
• 1.00.57
• 1.00.58
• 1.00.59
• 1.00.60
• 1.00.61
• 1.00.62
• 1.00.63
• 1.00.64
• 1.00.65
• 1.00.66
• 1.00.67
• 1.00.68
• 1.00.69
• 1.00.70
• 1.00.71
• 1.00.72
• 1.00.73
• 1.00.74
• 1.00.75
• 1.00.76
• 1.00.77
• 1.00.78
• 1.00.79
• 1.00.80
• 1.00.81
• 1.00.82
• 1.00.83
• 1.00.84

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion