PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-47962 Delta Electronics CVE debrief

A stack-based buffer overflow vulnerability in Delta Electronics CNCSoft-G2 version 2.1.0.10 allows code execution through user interaction with malicious content. The flaw stems from improper length validation when copying user-supplied data to a fixed-length stack buffer. An attacker can leverage social engineering to manipulate an insider into visiting a malicious page or opening a malicious file, resulting in arbitrary code execution within the context of the current process. The vulnerability was disclosed by CISA on October 10, 2024, with a CVSS 3.1 score of 7.8 (HIGH).

Vendor
Delta Electronics
Product
CNCSoft-G2
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-10-10
Original CVE updated
2024-10-10
Advisory published
2024-10-10
Advisory updated
2024-10-10

Who should care

Organizations operating Delta Electronics CNCSoft-G2 in manufacturing environments, particularly those in CNC machining and industrial automation. Security teams responsible for OT/ICS environments, system administrators managing shop floor workstations, and personnel involved in supply chain or operational technology security should prioritize this patch due to the high severity and potential for code execution through relatively simple social engineering tactics.

Technical summary

CVE-2024-47962 is a stack-based buffer overflow in Delta Electronics CNCSoft-G2 version 2.1.0.10. The vulnerability occurs due to insufficient validation of user-supplied data length before copying to a fixed-length stack buffer. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a local attack vector requiring user interaction but no privileges, with high impact on confidentiality, integrity, and availability. Successful exploitation requires an attacker to socially engineer an insider into visiting a malicious page or opening a malicious file, after which code executes in the context of the current process. The vendor has released version 2.1.0.16 to address this vulnerability.

Defensive priority

HIGH

Recommended defensive actions

  • Update Delta Electronics CNCSoft-G2 to version 2.1.0.16 or later as provided by the vendor
  • Implement network segmentation to limit exposure of industrial control systems to untrusted networks
  • Apply principle of least privilege for user accounts accessing CNCSoft-G2 systems
  • Conduct user awareness training on recognizing and avoiding social engineering attacks, particularly regarding unsolicited emails with web links or attachments
  • Deploy application whitelisting to prevent execution of unauthorized code on systems running CNCSoft-G2
  • Monitor for anomalous process behavior and unexpected network connections from CNCSoft-G2 applications
  • Establish incident response procedures specifically for industrial control system compromises

Evidence notes

CISA ICS Advisory ICSA-24-284-21 confirms the vulnerability affects CNCSoft-G2 version 2.1.0.10. The advisory identifies the root cause as lack of proper length validation for user-supplied data copied to a fixed-length stack-based buffer. The attack vector requires local access with user interaction (AV:L/AC:L/PR:N/UI:R per CVSS 3.1).

Sources and references

Verified primary and authoritative sources

  • CVE-2024-47962 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-47962

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-47962 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-47962

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-284-21.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-21

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.