PT-2022-13861 · Delta Electronics · Cncsoft

Published 2022-03-01 · Updated 2022-09-07 · CVE-2022-1404

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Delta Electronics CNCSoft versions prior to 1.01.32

Description The issue arises from improper input sanitization when processing a specific project file, leading to a possible out-of-bounds read condition. This can potentially result in information disclosure. There is also a mention of a stack-based buffer overflow that could allow for remote code execution.

Recommendations For versions prior to 1.01.32, update to version 1.01.32 or later to resolve the issue. As a temporary workaround, consider restricting the processing of project files from untrusted sources to minimize the risk of exploitation. Avoid using the ScreenEditor DPB file parsing functionality until the issue is resolved.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-1404

ZDI-22-421

ZDI-22-422

Affected Products

Cncsoft

References · 6

• https://osv.dev/vulnerability/CVE-2022-1404 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-421 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-132-01 · Patch
• https://zerodayinitiative.com/advisories/ZDI-22-422 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1404 · Security Note
• https://t.me/cibsecurity/49124 · Telegram Post