Natnael Samson

**Name of the Vulnerable Software and Affected Versions** Delta Electronics CNCSoft-G2 (affected versions not specified) **Description** The issue is related to the lack of proper initialization of memory prior to accessing it in Delta Electronics CNCSoft-G2. An attacker can manipulate users into visiting a malicious page or file, which can leverage this issue to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics CNCSoft-G2 (affected versions not specified) **Description** The issue is related to a lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This allows an attacker to manipulate users into visiting a malicious page or file, which can lead to the execution of code in the context of the current process. The vulnerability enables remote attackers to execute arbitrary code on affected installations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics CNCSoft-G2 version 2.1.0.10 **Description** The issue is related to a lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. This allows an attacker to manipulate an insider to visit a malicious page or file, potentially leading to the execution of code in the context of the current process. The vulnerability poses a serious cybersecurity threat due to the possibility of remote code execution. **Recommendations** For Delta Electronics CNCSoft-G2 version 2.1.0.10, upgrade immediately to mitigate the risk of system compromise on affected devices. As a temporary workaround, consider restricting access to potentially vulnerable file parsing functions until a patch is available. Avoid using the software to parse untrusted files, such as ALM, DPAX, or CMT files, until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics CNCSoft-G2 (affected versions not specified) **Description** The issue is related to a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. This allows an attacker to manipulate users into visiting a malicious page or file, potentially executing code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics CNCSoft-G2 (affected versions not specified) **Description** The issue is related to a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. This can be exploited by an attacker to execute code in the context of the current process by manipulating users into visiting a malicious page or file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Delta Electronics DIAScreen (affected versions not specified) Description: The issue is related to a stack-based buffer overflow in the BACnetParameter component. If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, this overflow can be exploited, allowing the attacker to remotely execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Delta Electronics DIAScreen (affected versions not specified) Description: The issue is related to a stack-based buffer overflow in the CEtherIPTagItem component of Delta Electronics DIAScreen. This can be exploited if an attacker tricks a valid user into running DIAScreen with a file containing malicious code, allowing the attacker to remotely execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Delta Electronics DIAScreen (affected versions not specified) Description: The issue is related to a stack-based buffer overflow in the BACnetObjectInfo component of Delta Electronics DIAScreen. This can be exploited if an attacker tricks a valid user into running DIAScreen with a file containing malicious code, allowing the attacker to remotely execute arbitrary code. The vulnerability is actively being exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics CNCSoft-G2 (affected versions not specified) **Description** The issue is related to a lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. This can be exploited if a target visits a malicious page or opens a malicious file, allowing an attacker to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics CNCSoft-G2 (affected versions not specified) **Description** The issue is related to a lack of proper validation of user-supplied data, which can result in a memory corruption condition. This can be exploited if a target visits a malicious page or opens a malicious file, allowing an attacker to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics CNCSoft-G2 (affected versions not specified) **Description** The issue is related to a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. This can be leveraged by an attacker to execute code in the context of the current process if a target visits a malicious page or opens a malicious file. The vulnerability is related to DPAX file parsing and can lead to remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics CNCSoft-G2 (affected versions not specified) **Description** The issue is related to a lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. This can be exploited if a target visits a malicious page or opens a malicious file, allowing an attacker to execute code in the context of the current process. The vulnerability is related to the DPAX file parsing and can lead to remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics CNCSoft-G2 (affected versions not specified) **Description** The issue is related to a lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. This allows an attacker to execute code in the context of the current process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics DOPSoft (affected versions not specified) **Description** The issue is a stack-based buffer overflow that may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LAquis SCADA (affected versions not specified) **Description** The issue is related to the LAquis SCADA system, where an attacker can access locations outside of their own directory. This is due to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow an attacker to read, modify, or delete data, or execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics DIAScreen versions 1.2.1.23 and prior **Description** The issue is related to a buffer overflow in memory due to improper restrictions of operations. This could allow an attacker to remotely execute arbitrary code. **Recommendations** For Delta Electronics DIAScreen versions 1.2.1.23 and prior, consider restricting access to the system until a patch is available to prevent potential exploitation. As a temporary workaround, consider disabling any functionality that may trigger the buffer overflow until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics DIAScreen versions 1.2.1.23 and prior **Description** The issue is related to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. This is a result of a buffer overflow vulnerability in the DIAScreen development environment for industrial control system management. **Recommendations** For Delta Electronics DIAScreen versions 1.2.1.23 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Delta Electronics DIAScreen versions 1.2.1.23 and prior **Description** The issue is related to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code. This is a result of a vulnerability in the development environment for industrial equipment control systems, specifically in the DIAScreen software. **Recommendations** For Delta Electronics DIAScreen versions 1.2.1.23 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: WECON LeviStudioU versions 2019-09-21 and prior Description: The issue concerns multiple stack-based buffer overflow instances while parsing project files, which may allow an attacker to execute arbitrary code. This occurs in various tags, including Alarm, XY, BaseSet, Trend, and HmiSet, where parameters such as `WordAddr`, `CurScrIdAddr`, `HMINAME`, `Style`, `bitaddr`, `ScrIdWordAddr`, `PowerEnterTime`, and `EnterTime` are vulnerable to buffer overflow attacks. Recommendations: For WECON LeviStudioU versions 2019-09-21 and prior, as a temporary workaround, consider disabling the parsing of project files until a patch is available. Restrict access to the UMP file parsing functionality to minimize the risk of exploitation. Avoid using vulnerable tags and parameters, such as `WordAddr`, `CurScrIdAddr`, `HMINAME`, `Style`, `bitaddr`, `ScrIdWordAddr`, `PowerEnterTime`, and `EnterTime`, in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Advantech WebAccess versions 9.02 and prior **Description** The issue is a heap-based buffer overflow that may allow an attacker to remotely execute code. **Recommendations** For Advantech WebAccess versions 9.02 and prior, update to a version later than 9.02 to resolve the issue.