OTPulse
FeedAboutContact

Delta Electronics Industrial Automation CNCSoft ScreenEditor

Plan Patch7.8ICS-CERT ICSA-20-077-01Mar 17, 2020
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Delta Electronics CNCSoft ScreenEditor versions 1.00.96 and prior contain buffer overflow vulnerabilities (CWE-121, CWE-125) that may allow information disclosure, remote code execution, or cause the application to crash. The vulnerabilities are triggered through processing of untrusted files and are not remotely exploitable.

What this means
What could happen
An attacker could cause CNCSoft ScreenEditor to crash, leak sensitive information, or execute arbitrary code on a machine running the software if tricked into opening a malicious file. This affects manufacturing facilities using Delta's industrial automation software for CNC machine programming and configuration.
Who's at risk
Manufacturing facilities and machine shops using Delta Electronics CNCSoft ScreenEditor for CNC machine programming and industrial automation control. Operators, programmers, and maintenance personnel who use the software to create or modify machine control programs are at risk if they open untrusted project files.
How it could be exploited
An attacker must trick a user into opening a malicious file (e.g., project file, configuration file) with a specially crafted payload in CNCSoft ScreenEditor. The application processes the file locally without sufficient bounds checking, triggering a buffer overflow that could leak memory contents, crash the program, or execute attacker code with the privileges of the user running the application.
Prerequisites
  • User interaction required: victim must open a malicious file in CNCSoft ScreenEditor
  • CNCSoft ScreenEditor version 1.00.96 or earlier installed on the system
  • Local or network access to deliver the malicious file (e.g., email, file share)
buffer overflow vulnerabilitylocal code execution possiblerequires user interactionaffects industrial automation softwareno patch available for older versions
Exploitability
Low exploit probability (EPSS 0.3%)
Affected products (1)
ProductAffected VersionsFix Status
CNCSoft ScreenEditor: v1.00.96 and prior≤ 1.00.961.00.98 (via CNCSoft v1.01.24 or later)
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDOnly open project files and configurations from trusted sources; block or quarantine external files before opening in ScreenEditor
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate CNCSoft to version 1.01.24 with ScreenEditor v1.00.98 or later
Long-term hardening
0/1
HARDENINGSegment the CNC programming network from operational plant networks to limit lateral movement if a workstation is compromised
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/a75cba61-63e1-49ce-a9c0-5175ee7a7139