Search
Find a vulnerability
Search criteria
2 vulnerabilities found for CNCSoft-B v1.0.0.4 DOPSoft by Delta Electronics
CVE-2024-1595 (GCVE-0-2024-1595)
Vulnerability from nvd – Published: 2024-02-29 19:16 – Updated: 2024-08-22 18:09
VLAI
Title
Delta Electronics CNCSoft-B DOPSoft Uncontrolled Search Path Element
Summary
Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82
insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Delta Electronics | CNCSoft-B v1.0.0.4 DOPSoft |
Affected:
0 , < v4.0.0.82
(custom)
|
|
| delta_electronics | cncsoft-b |
Affected:
0 , < 4.0.0.82
(custom)
cpe:2.3:a:delta_electronics:cncsoft-b:*:*:*:*:*:*:*:* |
Date Public
2024-02-22 18:00
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:delta_electronics:cncsoft-b:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cncsoft-b",
"vendor": "delta_electronics",
"versions": [
{
"lessThan": "4.0.0.82",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1595",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-05T20:55:43.771950Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T18:09:41.923Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:48:20.646Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-053-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CNCSoft-B v1.0.0.4 DOPSoft",
"vendor": "Delta Electronics",
"versions": [
{
"lessThan": "v4.0.0.82",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Delta Electronics reported this vulnerability to CISA."
}
],
"datePublic": "2024-02-22T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDelta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.\u003c/span\u003e\n\n"
}
],
"value": "Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82\n\n insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-29T19:16:08.644Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-053-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDelta recommends users upgrade to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1\u0026amp;q=cncsoft\u0026amp;sort_expr=cdate\u0026amp;sort_dir=DESC\"\u003eCNCSoft-B v1.0.0.4\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e, which includes DOPSoft v4.0.0.94.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "\nDelta recommends users upgrade to CNCSoft-B v1.0.0.4 https://downloadcenter.deltaww.com/en-US/DownloadCenter , which includes DOPSoft v4.0.0.94.\n\n\n"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Delta Electronics CNCSoft-B DOPSoft Uncontrolled Search Path Element",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-1595",
"datePublished": "2024-02-29T19:16:08.644Z",
"dateReserved": "2024-02-16T21:56:56.319Z",
"dateUpdated": "2024-08-22T18:09:41.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-1595 (GCVE-0-2024-1595)
Vulnerability from cvelistv5 – Published: 2024-02-29 19:16 – Updated: 2024-08-22 18:09
VLAI
Title
Delta Electronics CNCSoft-B DOPSoft Uncontrolled Search Path Element
Summary
Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82
insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Delta Electronics | CNCSoft-B v1.0.0.4 DOPSoft |
Affected:
0 , < v4.0.0.82
(custom)
|
|
| delta_electronics | cncsoft-b |
Affected:
0 , < 4.0.0.82
(custom)
cpe:2.3:a:delta_electronics:cncsoft-b:*:*:*:*:*:*:*:* |
Date Public
2024-02-22 18:00
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:delta_electronics:cncsoft-b:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cncsoft-b",
"vendor": "delta_electronics",
"versions": [
{
"lessThan": "4.0.0.82",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1595",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-05T20:55:43.771950Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T18:09:41.923Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:48:20.646Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-053-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CNCSoft-B v1.0.0.4 DOPSoft",
"vendor": "Delta Electronics",
"versions": [
{
"lessThan": "v4.0.0.82",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Delta Electronics reported this vulnerability to CISA."
}
],
"datePublic": "2024-02-22T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDelta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.\u003c/span\u003e\n\n"
}
],
"value": "Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82\n\n insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-29T19:16:08.644Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-053-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDelta recommends users upgrade to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1\u0026amp;q=cncsoft\u0026amp;sort_expr=cdate\u0026amp;sort_dir=DESC\"\u003eCNCSoft-B v1.0.0.4\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e, which includes DOPSoft v4.0.0.94.\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "\nDelta recommends users upgrade to CNCSoft-B v1.0.0.4 https://downloadcenter.deltaww.com/en-US/DownloadCenter , which includes DOPSoft v4.0.0.94.\n\n\n"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Delta Electronics CNCSoft-B DOPSoft Uncontrolled Search Path Element",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-1595",
"datePublished": "2024-02-29T19:16:08.644Z",
"dateReserved": "2024-02-16T21:56:56.319Z",
"dateUpdated": "2024-08-22T18:09:41.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}