Delta Electronics CNCSoft-G2

An attacker with local access who can trick a user into clicking a malicious link or opening an attachment could execute arbitrary code on the CNCSoft-G2 system, potentially allowing them to modify control logic, alter process parameters, or disrupt manufacturing or industrial operations.

Manufacturing and industrial automation facilities using Delta Electronics CNCSoft-G2 (versions v2.1.0.10 or earlier) for CNC machine control, process automation, or motion control should prioritize updating this software. Risk is highest in environments where engineering workstations or operator terminals are connected to email or general internet access.

An attacker creates a malicious email or internet link targeting a CNCSoft-G2 operator or engineer. When the user clicks the link or opens an attachment on a system running vulnerable CNCSoft-G2, the attacker's code executes with the privileges of the logged-in user. From there, the attacker can modify control software, process setpoints, or stop operations.