CVE-2025-58317
📋 TL;DR
Delta Electronics CNCSoft-G2 has a stack-based buffer overflow vulnerability due to improper file validation. Attackers can execute arbitrary code by tricking users into opening malicious files. This affects all users of vulnerable CNCSoft-G2 versions.
💻 Affected Systems
- Delta Electronics CNCSoft-G2
📦 What is this software?
Cncsoft G2 by Deltaww
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining control of CNC machines, potentially causing physical damage or production disruption.
Likely Case
Local privilege escalation leading to unauthorized access to industrial control systems and sensitive manufacturing data.
If Mitigated
Limited impact if proper network segmentation and user awareness training prevent malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00017_CNCSoft-G2_File%20Parsing%20Stack-based%20Buffer%20Overflow%20Vulnerability.pdf
Restart Required: Yes
Instructions:
1. Download the patch from Delta Electronics official website
2. Close all CNCSoft-G2 applications
3. Run the patch installer
4. Restart the system
5. Verify the patch is applied correctly
🔧 Temporary Workarounds
Restrict File Access
windowsLimit user permissions to prevent opening untrusted files with CNCSoft-G2
Application Whitelisting
windowsConfigure Windows AppLocker or similar to restrict which files CNCSoft-G2 can open
🧯 If You Can't Patch
- Implement strict network segmentation to isolate CNC systems from general network traffic
- Provide user awareness training about the risks of opening untrusted files with industrial software
🔍 How to Verify
Check if Vulnerable:
Check CNCSoft-G2 version against vendor advisory. If using unpatched version, system is vulnerable.Check Version:
Check version in CNCSoft-G2 application Help > About menuVerify Fix Applied:
Verify CNCSoft-G2 version matches or exceeds patched version specified in vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes of CNCSoft-G2
- Suspicious file access attempts by CNCSoft-G2 process
Network Indicators:
- Unusual network connections originating from CNC systems
- File transfers to CNC systems from untrusted sources
SIEM Query:
Process:cncsoft.exe AND (EventID:1000 OR EventID:1001) OR FileAccess:*.cnc FROM untrusted_source