PT-2024-1947 · Delta Electronics · Cncsoft-B Dopsoft

Sean De Regge · Published 2024-02-22 · Updated 2024-05-13 · CVE-2024-1595

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delta Electronics CNCSoft-B DOPSoft versions prior to 4.0.0.82

Description The issue is related to the insecure loading of libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed. This is due to an uncontrolled search path element. Exploitation of the issue may allow an attacker to execute arbitrary code.

Recommendations For versions prior to 4.0.0.82, update to version 4.0.0.82 or later to resolve the issue. As a temporary workaround, consider restricting access to the system where the software is installed to minimize the risk of exploitation. Avoid using the software until the issue is resolved.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2024-01743

CVE-2024-1595

ZDI-24-441

Affected Products

Cncsoft-B Dopsoft

References · 8

• https://zerodayinitiative.com/advisories/ZDI-24-441 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1595 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01743 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-1595 · Security Note
• https://twitter.com/CVEnew/status/1763283652538958283 · Twitter Post
• https://t.me/cvenotify/72772 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1763332549164568662 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-053-01 · Note