PT-2019-12121 · Delta Electronics · Cncsoft Screeneditor

Nattisamson · Published 2019-07-22 · Updated 2020-10-02 · CVE-2019-10982

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delta Electronics CNCSoft ScreenEditor versions 1.00.89 and prior

Description The issue is related to multiple heap-based buffer overflow vulnerabilities that can be exploited by processing specially crafted project files. This allows an attacker to remotely execute arbitrary code due to a lack of user input validation before copying data from project files onto the heap.

Recommendations For Delta Electronics CNCSoft ScreenEditor versions 1.00.89 and prior, consider disabling the project file processing feature until a patch is available to prevent remote code execution. Restrict access to the heap to minimize the risk of exploitation. Avoid using the software to process untrusted project files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2019-10982

ZDI-19-672

ZDI-19-673

Affected Products

Cncsoft Screeneditor

References · 5

• https://osv.dev/vulnerability/CVE-2019-10982 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-19-672 · Security Note
• https://us-cert.gov/ics/advisories/icsa-19-192-01 · Patch
• https://zerodayinitiative.com/advisories/ZDI-19-673 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-10982 · Security Note