A critical stack-based buffer overflow in Delta Electronics CNCSoft-G2 allows unauthenticated attackers to execute arbitrary code via malicious file processing.

The application fails to properly validate user-supplied files, leading to a stack-based buffer overflow (CWE-121). An attacker can trigger this vulnerability by enticing a user to open a specially crafted malicious file, resulting in code execution within the context of the current process.

The vulnerability carries a CVSS score of 7.8, indicating a high severity level. Successful exploitation grants an attacker the ability to execute arbitrary code, which can lead to complete system compromise, unauthorized data access, or the disruption of industrial control processes. Given the nature of CNC software, such an event could result in significant operational downtime and potential physical safety risks in a manufacturing environment.

Immediate Action: Update the CNCSoft-G2 software to version 2.1.0.34 or later as specified in the official vendor advisory.

Proactive Monitoring: Monitor system logs for unexpected application crashes or anomalous file access patterns that may indicate an attempt to trigger the buffer overflow.

Compensating Controls: Implement strict file handling policies that restrict the opening of untrusted files within the CNC environment and utilize endpoint protection solutions to detect malicious file execution.

Public Exploit Available: Unknown

The risk posed by this stack-based buffer overflow is significant, particularly due to the potential for full code execution. Administrators should prioritize the update to version 2.1.0.34 across all affected CNCSoft-G2 installations immediately. Failure to patch leaves systems vulnerable to exploitation through common file-based attack vectors.