CVE-2026-3094
📋 TL;DR
Delta Electronics CNCSoft-G2 has a file parsing vulnerability that allows out-of-bounds write when processing malicious files. This enables remote code execution in the context of the current process. Industrial control system operators using CNCSoft-G2 are affected.
💻 Affected Systems
- Delta Electronics CNCSoft-G2
📦 What is this software?
Cncsoft G2 by Deltaww
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of CNC systems leading to production disruption, equipment damage, or safety incidents through arbitrary code execution.
Likely Case
Attackers gain control of CNC machines to disrupt manufacturing processes or steal intellectual property.
If Mitigated
Limited impact through network segmentation and proper file handling procedures.
🎯 Exploit Status
Requires user interaction to open malicious file; exploitation details not publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version with Delta-PCSA-2026-00004 fix
Vendor Advisory: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00004_CNCSoft-G2_File%20Parsing%20Out-Of-Bounds%20Write.pdf
Restart Required: Yes
Instructions:
1. Download patch from Delta Electronics support portal. 2. Backup CNC configurations. 3. Install patch following vendor instructions. 4. Restart system and verify functionality.
🔧 Temporary Workarounds
Restrict file execution
windowsConfigure Windows to prevent execution of untrusted files in CNCSoft-G2 context
Use Windows AppLocker or Software Restriction Policies to block untrusted file types
User training
allTrain operators to only open files from trusted sources
🧯 If You Can't Patch
- Network segmentation: Isolate CNC systems from business networks and internet
- Implement application whitelisting to prevent unauthorized file execution
🔍 How to Verify
Check if Vulnerable:
Check CNCSoft-G2 version against vendor advisory; if pre-patch version, system is vulnerable.Check Version:
Check version in CNCSoft-G2 Help > About menu or Windows Programs and FeaturesVerify Fix Applied:
Verify CNCSoft-G2 version matches patched version in vendor advisory and test file parsing functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected file parsing errors in CNCSoft-G2 logs
- Unusual process creation from CNCSoft-G2
Network Indicators:
- Unexpected file transfers to CNC systems
- Phishing emails targeting operators
SIEM Query:
Process creation where parent process contains 'CNCSoft' AND command line contains file operations