CVE-2020-27293
📋 TL;DR
This vulnerability in Delta Electronics CNCSoft-B allows attackers to execute arbitrary code by exploiting a type confusion issue when processing malicious project files. It affects industrial control systems using CNCSoft-B version 1.0.0.2 and earlier. Attackers could gain control of CNC machines and manufacturing equipment.
💻 Affected Systems
- Delta Electronics CNCSoft-B
📦 What is this software?
Cncsoft B by Deltaww
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of CNC machines leading to physical damage, production disruption, or safety incidents through arbitrary code execution.
Likely Case
Unauthorized access to CNC systems allowing data theft, manipulation of manufacturing processes, or ransomware deployment.
If Mitigated
Limited impact through network segmentation and proper access controls preventing project file uploads.
🎯 Exploit Status
Exploitation requires social engineering or existing access to upload malicious project files. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.0.0.3 or later
Vendor Advisory: https://www.deltaww.com/en-US/Support/Downloads/Detail?code=CNCSoft-B
Restart Required: Yes
Instructions:
1. Download latest version from Delta Electronics support portal. 2. Uninstall current CNCSoft-B. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Restrict Project File Processing
windowsLimit who can load project files and from which locations
Implement Windows file permissions to restrict .proj file access
Configure application whitelisting to control execution
Network Segmentation
allIsolate CNC systems from general network traffic
Configure firewall rules to block unnecessary inbound/outbound traffic
Implement VLAN segmentation for OT networks
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized project file uploads
- Monitor for suspicious file processing activities and network connections
🔍 How to Verify
Check if Vulnerable:
Check CNCSoft-B version in Help > About menu. If version is 1.0.0.2 or earlier, system is vulnerable.Check Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 1.0.0.3 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unusual project file loading from unexpected locations
- Multiple failed project file parsing attempts
- Unexpected process creation from CNCSoft-B
Network Indicators:
- Unexpected outbound connections from CNC systems
- File transfers to/from CNC systems outside normal patterns
SIEM Query:
source="CNCSoft-B" AND (event="FileLoad" OR event="ProcessCreate") | where file_path contains ".proj"