PT-2021-11372 · Delta Electronics · Cncsoft-B

Kimiya · Published 2021-01-11 · Updated 2021-03-09 · CVE-2020-27289

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Delta Electronics CNCSoft-B versions 1.0.0.2 and prior

Description: The issue is related to a null pointer dereference problem that occurs while processing project files. This may allow an attacker to execute arbitrary code. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations: For Delta Electronics CNCSoft-B versions 1.0.0.2 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Pointer Dereference

NULL Pointer Dereference

Weakness Enumeration

CWE-822

CWE-476

Related Identifiers

CVE-2020-27289

ZDI-21-040

Affected Products

Cncsoft-B

References · 5

• https://osv.dev/vulnerability/CVE-2020-27289 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27289 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-040 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04 · Note
• https://t.me/cvenotify/11025 · Telegram Post