VULNERABILITY INTELLIGENCE
CVE-2019-10951
CVSS score7.8 HIGH
EPSS probability2.94%
CISA KEVNot currently listed
Published2019-04-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. There is a lack of user input validation before copying data from project files onto the heap.
Weakness classification
- CWE-122: Heap-based Buffer Overflow
- CWE-787: Out-of-bounds Write
Primary references
- ics-cert@hq.dhs.gov — Third Party Advisory, VDB Entry
- ics-cert@hq.dhs.gov — Patch, Third Party Advisory, US Government Resource
- ics-cert@hq.dhs.gov — Third Party Advisory, VDB Entry
- ics-cert@hq.dhs.gov — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory, US Government Resource
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry