{"containers": {"cna": {"affected": [{"product": "Delta Industrial Automation CNCSoft", "vendor": "n/a", "versions": [{"status": "affected", "version": "CNCSoft ScreenEditor Version 1.00.88 and prior."}]}], "descriptions": [{"lang": "en", "value": "Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. This may occur because CNCSoft lacks user input validation before copying data from project files onto the stack."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "STACK-BASED BUFFER OVERFLOW CWE-121", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-04-18T08:06:00", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-417/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-399/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-401/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-402/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-403/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-404/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-410/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-400/"}, {"name": "107989", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/107989"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "ID": "CVE-2019-10947", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Delta Industrial Automation CNCSoft", "version": {"version_data": [{"version_value": "CNCSoft ScreenEditor Version 1.00.88 and prior."}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. This may occur because CNCSoft lacks user input validation before copying data from project files onto the stack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "STACK-BASED BUFFER OVERFLOW CWE-121"}]}]}, "references": {"reference_data": [{"name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-417/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-417/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-399/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-399/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-401/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-401/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-402/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-402/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-403/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-403/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-404/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-404/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-410/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-410/"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-19-400/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-400/"}, {"name": "107989", "refsource": "BID", "url": "http://www.securityfocus.com/bid/107989"}]}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2019-10947", "datePublished": "2019-04-17T14:04:53", "dateReserved": "2019-04-08T00:00:00", "dateUpdated": "2019-04-18T08:06:00", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:cncsoft_screeneditor:*:*:*:*:*:*:*:*", "matchCriteriaId": "86DA8ED1-20DF-4CDA-953B-588DBC2CE2B0", "versionEndIncluding": "1.00.88", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.88 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, allowing an attacker to remotely execute arbitrary code. This may occur because CNCSoft lacks user input validation before copying data from project files onto the stack."}, {"lang": "es", "value": "Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor versi\u00f3n 1.00.88 y anteriores. Se pueden aprovechar m\u00faltiples vulnerabilidades de desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria al procesar archivos de proyecto especialmente creados, lo que permite a un atacante ejecutar c\u00f3digo arbitrario de forma remota. Esto puede ocurrir porque CNCSoft carece de comprobaci\u00f3n de entrada del usuario antes de copiar datos de los archivos del proyecto en la pila."}], "id": "CVE-2019-10947", "lastModified": "2020-10-02T14:44:09.410", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-04-17T15:29:00.750", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/107989"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-106-01"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-399/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-400/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-401/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-402/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-403/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-404/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-410/"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-417/"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-121"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}