CVE-2024-1941: Delta CNCSoft-B Buffer Overflow Flaw

CVE-2024-1941 Overview

CVE-2024-1941 is a stack-based buffer overflow vulnerability in Delta Electronics CNCSoft-B versions 1.0.0.4 and prior. CNCSoft-B is a human-machine interface (HMI) software used to configure and monitor Delta CNC controllers in industrial environments. An attacker who convinces a user to open a crafted file can trigger memory corruption and execute arbitrary code in the context of the CNCSoft-B process. The flaw is tracked under [CWE-121] (Stack-based Buffer Overflow) and [CWE-787] (Out-of-bounds Write). CISA published the issue in ICS advisory ICSA-24-060-01.

Critical Impact
Successful exploitation allows arbitrary code execution on operator workstations used to manage Delta CNC industrial controllers.

Affected Products

Delta Electronics CNCSoft-B version 1.0.0.4
Delta Electronics CNCSoft-B all prior versions
Operator and engineering workstations running CNCSoft-B in industrial control environments

Discovery Timeline

2024-03-01 - CVE-2024-1941 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1941

Vulnerability Analysis

CNCSoft-B fails to validate the size of input data written to a fixed-size stack buffer during file parsing. When the software processes a malformed project or configuration file, oversized data overwrites adjacent stack memory, including the saved return address and structured exception handlers. An attacker who controls the overwritten values can redirect execution to attacker-supplied shellcode.

Exploitation requires local access and user interaction, typically opening a crafted file delivered by phishing or removable media. Successful exploitation yields code execution with the privileges of the user running CNCSoft-B. In industrial control system (ICS) environments, that user often has access to programmable logic controllers (PLCs) and CNC machinery, extending the impact beyond the compromised host.

Root Cause

The root cause is missing bounds checking on user-controlled input during file processing, classified as [CWE-121] Stack-based Buffer Overflow and [CWE-787] Out-of-bounds Write. The parser copies untrusted data into a stack-allocated buffer without verifying the destination size against the source length.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious CNCSoft-B project file and delivers it to a target operator. When the operator opens the file, the parser triggers the overflow. See the CISA ICS Advisory ICSA-24-060-01 for vendor guidance.

No public proof-of-concept exploit is currently available. The vulnerability mechanism involves attacker-controlled bytes overwriting the saved return address on the stack during file parsing, redirecting execution flow to shellcode embedded in the malicious file.

Detection Methods for CVE-2024-1941

Indicators of Compromise

Unexpected crashes of CNCSoft-B.exe or associated parser modules on engineering workstations
CNCSoft-B project files received from untrusted sources or delivered via email attachments
Child processes spawned by CNCSoft-B that are not part of normal operator workflow, such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections originating from the CNCSoft-B process to non-Delta infrastructure

Detection Strategies

Monitor process creation events where CNCSoft-B is the parent of shells, scripting engines, or LOLBins
Alert on Windows Error Reporting entries indicating stack corruption faults in CNCSoft-B
Inspect file transfers to ICS workstations for CNCSoft-B project files of unusual size or origin

Monitoring Recommendations

Enable command-line and process-lineage logging on all engineering workstations running CNCSoft-B
Forward endpoint telemetry from the operational technology (OT) DMZ to a centralized detection platform
Baseline normal CNCSoft-B behavior and alert on deviations such as new module loads or memory allocations flagged as executable

How to Mitigate CVE-2024-1941

Immediate Actions Required

Inventory all systems running Delta Electronics CNCSoft-B and identify versions at or below 1.0.0.4
Restrict CNCSoft-B project file handling to trusted operators and vetted file sources
Block CNCSoft-B project file types at email gateways and enforce content inspection on removable media
Apply network segmentation to isolate engineering workstations from general IT networks per ISA/IEC 62443

Patch Information

Refer to the CISA ICS Advisory ICSA-24-060-01 for the current remediation status from Delta Electronics. Contact Delta Electronics support directly to obtain the fixed release of CNCSoft-B and confirm applicability to your installed version.

Workarounds

Do not open CNCSoft-B project files from unverified sources
Run CNCSoft-B under a standard user account rather than an administrator to limit post-exploitation impact
Deploy application allowlisting to prevent execution of unauthorized child processes launched by CNCSoft-B
Follow CISA defense-in-depth guidance for ICS: minimize network exposure, place control system networks behind firewalls, and use VPNs for remote access

bash

# Example: Windows Defender Application Control policy fragment to constrain CNCSoft-B
# Block CNCSoft-B from spawning common LOLBins
New-CIPolicyRule -DriverFilePath "C:\Program Files\Delta Industrial Automation\CNCSoft-B\CNCSoft-B.exe" -Level FilePublisher