CVE-2024-1595 Overview
CVE-2024-1595 is a DLL hijacking vulnerability in Delta Electronics CNCSoft-B DOPSoft versions prior to v4.0.0.82. The software insecurely loads dynamic-link libraries, allowing an attacker to plant a malicious DLL in a location searched by the application. When a local user executes the vulnerable software, the attacker's DLL loads into the process and executes with the user's privileges. The flaw is tracked under [CWE-427: Uncontrolled Search Path Element]. Delta Electronics products are widely deployed in industrial control system (ICS) environments, and CISA published advisory ICSA-24-053-01 covering this issue.
Critical Impact
Successful exploitation grants arbitrary code execution in the context of the user running CNCSoft-B DOPSoft, enabling full compromise of the operator workstation.
Affected Products
- Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82
- Delta Electronics DOPSoft (bundled component)
- Engineering workstations running vulnerable CNCSoft-B installations
Discovery Timeline
- 2024-02-29 - CVE-2024-1595 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1595
Vulnerability Analysis
The vulnerability stems from insecure library loading behavior in CNCSoft-B DOPSoft. When the application starts, it resolves dependent DLLs using an unsafe search order rather than fully qualified paths. An attacker who can write a file to a directory that appears earlier in the search path than the legitimate system location can substitute a malicious DLL of the same name. The operating system loader then maps the attacker's DLL into the CNCSoft-B process and invokes its DllMain entry point, executing attacker-controlled code with the privileges of the interactive user.
Because CNCSoft-B is engineering software for human-machine interface (HMI) devices, it is commonly executed by operators and engineers on Windows workstations connected to industrial networks. Code execution on these hosts can pivot toward operational technology (OT) assets.
Root Cause
The root cause is classified as [CWE-427: Uncontrolled Search Path Element]. The application does not specify absolute paths when calling LoadLibrary or equivalent Windows APIs, and it does not apply mitigations such as SetDefaultDllDirectories or the LOAD_LIBRARY_SEARCH_SYSTEM32 flag. As a result, the Windows loader falls back to searching directories including the application's working directory and locations writable by non-privileged users.
Attack Vector
Exploitation requires local access and user interaction. An attacker plants a crafted DLL alongside a legitimate CNCSoft-B project file or in the application's working directory. When a victim opens the project or launches the software, the malicious DLL loads. See the CISA ICS Advisory ICSA-24-053-01 for vendor-provided technical details.
Detection Methods for CVE-2024-1595
Indicators of Compromise
- Unexpected DLL files residing in CNCSoft-B or DOPSoft installation and project directories
- Child processes spawned by CNCSoft-B.exe or DOPSoft.exe that deviate from historical baselines
- Outbound network connections originating from CNCSoft-B or DOPSoft process trees
- DLL files with recent write timestamps in directories preceding System32 in the loader search order
Detection Strategies
- Hunt for module loads by CNCSoft-B and DOPSoft processes where the DLL path is outside standard installation or system directories
- Correlate project file open events with subsequent DLL writes in the same directory
- Alert on writes of unsigned or newly created DLLs to directories referenced by engineering software
Monitoring Recommendations
- Enable Sysmon Event ID 7 (Image Loaded) on engineering workstations and forward to a centralized analytics platform
- Baseline expected DLL load paths for CNCSoft-B and DOPSoft, then alert on deviations
- Monitor file creation events in HMI project directories that store .dop and related artifacts
How to Mitigate CVE-2024-1595
Immediate Actions Required
- Upgrade CNCSoft-B DOPSoft to version 4.0.0.82 or later on all affected workstations
- Restrict write permissions on CNCSoft-B installation and project directories to administrators only
- Only open project files received from trusted sources and stored in controlled locations
- Segment engineering workstations from general-purpose corporate networks
Patch Information
Delta Electronics released a fixed build in CNCSoft-B DOPSoft v4.0.0.82. Users should download and install the updated software following guidance published in CISA ICS Advisory ICSA-24-053-01.
Workarounds
- Run CNCSoft-B DOPSoft under a standard user account rather than an administrator account to limit the impact of code execution
- Store project files in directories where only trusted administrators have write access
- Apply application allowlisting to prevent unsigned DLLs from loading into engineering software
- Restrict removable media use on workstations that run CNCSoft-B DOPSoft
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
