CVE-2025-58319: Deltaww CNCSoft-G2 RCE Vulnerability

CVE-2025-58319 Overview

CVE-2025-58319 is a stack-based buffer overflow [CWE-121] in Delta Electronics CNCSoft-G2, a human-machine interface (HMI) software used to configure and operate Delta CNC controllers. The vulnerability stems from missing validation of user-supplied files during parsing. When an operator opens a crafted project file, an attacker can execute arbitrary code in the context of the CNCSoft-G2 process.

Exploitation requires local user interaction, so social engineering or supply-chain delivery of a malicious file is the most likely attack path. The flaw affects industrial control system (ICS) environments where compromise can disrupt manufacturing operations.

Critical Impact

An attacker who convinces a CNCSoft-G2 user to open a malicious file gains code execution on the engineering workstation, providing a foothold into the operational technology (OT) network.

Affected Products

• Delta Electronics CNCSoft-G2 (all versions prior to the vendor fix referenced in Delta-PCSA-2025-00017)
• Engineering workstations running CNCSoft-G2 for Delta CNC controller configuration
• Windows hosts in OT environments using CNCSoft-G2 for project file editing

Discovery Timeline

• 2025-09-24 - CVE-2025-58319 published to the National Vulnerability Database (NVD)
• 2025-09-25 - Last updated in NVD database

Technical Details for CVE-2025-58319

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow triggered during file parsing in CNCSoft-G2. The application reads attacker-controlled data from a project file into a fixed-size stack buffer without verifying that the input length fits the allocated space. When oversized data is processed, adjacent stack memory — including the saved return address and structured exception handler records — is overwritten.

Because the corruption occurs on the stack of the CNCSoft-G2 process, an attacker who controls the overflow contents can redirect execution flow. The result is arbitrary code execution with the privileges of the user that opened the file. In typical ICS deployments, that user is an engineer with broad access to controllers and HMI assets.

The issue requires user interaction and local access, but it does not require prior privileges or authentication to the application. Confidentiality, integrity, and availability impacts are all rated high in the vendor scoring.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer during deserialization of CNCSoft-G2 project files. The parser trusts size fields or fixed offsets supplied by the file without bounds checking before copying data into a stack-allocated buffer. This pattern matches CWE-121: Stack-based Buffer Overflow.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious CNCSoft-G2 project file through phishing email, a removable drive, a shared network folder, or a compromised software supply chain. When the targeted engineer opens the file in CNCSoft-G2, the overflow executes the attacker's payload.

No verified public proof-of-concept is available for CVE-2025-58319 at the time of writing. Refer to the Delta Security Advisory (Delta-PCSA-2025-00017) for vendor-supplied technical details.

Detection Methods for CVE-2025-58319

Indicators of Compromise

• Unexpected child processes spawned by CNCSoft-G2.exe, particularly cmd.exe, powershell.exe, or rundll32.exe
• CNCSoft-G2 process crashes followed by suspicious binary execution or persistence creation on the same host
• CNCSoft-G2 project files arriving from external email, USB media, or untrusted file shares prior to a host anomaly

Detection Strategies

• Monitor process lineage on engineering workstations for CNCSoft-G2 spawning interactive shells, script interpreters, or network utilities
• Alert on memory protection violations, Data Execution Prevention (DEP) faults, or Windows Error Reporting events tied to the CNCSoft-G2 image
• Inspect file shares and email gateways for CNCSoft-G2 project files originating outside the engineering team's normal workflow

Monitoring Recommendations

• Forward Sysmon process creation, image load, and file creation events from OT engineering hosts to a central analytics platform
• Track outbound network connections initiated by CNCSoft-G2, which should normally communicate only with local CNC controllers
• Review module loads inside CNCSoft-G2 for unsigned DLLs or DLLs loaded from user-writable directories

How to Mitigate CVE-2025-58319

Immediate Actions Required

• Apply the patched CNCSoft-G2 version identified in Delta-PCSA-2025-00017 on all engineering workstations
• Restrict CNCSoft-G2 project file handling to files originating from trusted, internal sources only
• Train engineering staff to validate the origin of project files before opening them in CNCSoft-G2

Patch Information

Delta Electronics has published Delta-PCSA-2025-00017 covering the CNCSoft-G2 file parsing stack-based buffer overflow. Download the fixed release from Delta's official file center and verify the installed version after deployment. See the Delta Security Advisory for the affected and fixed version table.

Workarounds

• Segment engineering workstations from corporate email and general-purpose internet access to reduce malicious file delivery
• Run CNCSoft-G2 under a non-administrative Windows account so that exploitation does not yield elevated privileges
• Enforce application allowlisting on OT workstations to block payloads dropped by a successful exploit
• Disable automatic file association handlers that open CNCSoft-G2 project files without an explicit user action