CVE-2026-3094

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3094", "assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "state": "PUBLISHED", "assignerShortName": "Deltaww", "dateReserved": "2026-02-24T02:37:45.836Z", "datePublished": "2026-03-04T08:36:29.199Z", "dateUpdated": "2026-03-18T05:40:54.458Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "CNCSoft-G2", "vendor": "deltaww", "versions": [{"lessThan": "2.1.0.39", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:cncsoft-g2:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.1.0.39", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "reporter", "value": "Natnael Samson (@NattiSamson) working with TrendAI Zero Day Initiative"}, {"lang": "en", "type": "coordinator", "value": "CISA"}], "datePublic": "2026-03-04T08:20:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<strong>Delta Electronics CNCSoft-G2</strong><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.</span>"}], "value": "Delta Electronics CNCSoft-G2\u00a0lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "shortName": "Deltaww", "dateUpdated": "2026-03-18T05:40:54.458Z"}, "references": [{"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00004_CNCSoft-G2_File%20Parsing%20Out-Of-Bounds%20Write.pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Download and update to: v2.1.0.39 or later<br>"}], "value": "Download and update to: v2.1.0.39 or later"}], "source": {"discovery": "EXTERNAL"}, "title": "File Parsing Out-Of-Bounds Write in CNCSoft-G2", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T21:26:47.717714Z", "id": "CVE-2026-3094", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:26:58.086Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3094", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-04T21:26:47.717714Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T21:26:54.066Z"}}], "cna": {"title": "File Parsing Out-Of-Bounds Write in CNCSoft-G2", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Natnael Samson (@NattiSamson) working with TrendAI Zero Day Initiative"}, {"lang": "en", "type": "coordinator", "value": "CISA"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "deltaww", "product": "CNCSoft-G2", "versions": [{"status": "affected", "version": "0", "lessThan": "2.1.0.39", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Download and update to: v2.1.0.39 or later", "supportingMedia": [{"type": "text/html", "value": "Download and update to: v2.1.0.39 or later<br>", "base64": false}]}], "datePublic": "2026-03-04T08:20:00.000Z", "references": [{"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00004_CNCSoft-G2_File%20Parsing%20Out-Of-Bounds%20Write.pdf"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Delta Electronics CNCSoft-G2\u00a0lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.", "supportingMedia": [{"type": "text/html", "value": "<strong>Delta Electronics CNCSoft-G2</strong><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:cncsoft-g2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.1.0.39", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "shortName": "Deltaww", "dateUpdated": "2026-03-18T05:40:54.458Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3094", "state": "PUBLISHED", "dateUpdated": "2026-03-18T05:40:54.458Z", "dateReserved": "2026-02-24T02:37:45.836Z", "assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "datePublished": "2026-03-04T08:36:29.199Z", "assignerShortName": "Deltaww"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "CNCSoft-G2", "vendor": "deltaww", "versions": [{"lessThan": "2.1.0.39", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "759f5e80-c8e1-4224-bead-956d7b33c98b"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:cncsoft-g2:*:*:*:*:*:*:*:*", "matchCriteriaId": "12BCFE31-54C7-4A39-872D-6D44AA8BF082", "versionEndExcluding": "2.1.0.39", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Delta Electronics CNCSoft-G2\u00a0lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process."}, {"lang": "es", "value": "Delta Electronics CNCSoft-G2 carece de validaci\u00f3n adecuada del archivo proporcionado por el usuario. Si un usuario abre un archivo malicioso, un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del proceso actual."}], "id": "CVE-2026-3094", "lastModified": "2026-06-17T10:43:02.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3094", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T21:26:47.717714Z", "version": "2.0.3"}}]}, "published": "2026-03-04T09:15:58.457", "references": [{"source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "tags": ["Vendor Advisory"], "url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00004_CNCSoft-G2_File%20Parsing%20Out-Of-Bounds%20Write.pdf"}], "sourceIdentifier": "759f5e80-c8e1-4224-bead-956d7b33c98b", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.1.0.39)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CNCSoft-G2", "source": "cna", "vendor": "deltaww"}, "product": "cncsoft-g2", "vendor": "deltaww"}], "analysis": {"en": {"generated_at": "2026-04-16T13:41:47.637692+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011provided patch to update CNCSoft\u2011G2 to version v2.1.0.39 or later. ", "Restrict the use of the file import feature to trusted users or disable it entirely until a patch is applied. ", "Implement strict input validation on any file content processing functions to prevent uncontrolled buffer writes, addressing the underlying buffer\u2011overflow weakness identified by CWE\u2011787."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary code execution"}, "threat_synthesis": {"affected_systems": "Delta Electronics CNCSoft-G2 is affected by all versions released prior to v2.1.0.39. This includes any deployments using earlier builds of the software.", "description_and_impact": "A buffer overrun vulnerability exists in Delta Electronics CNCSoft-G2, where the application fails to validate the contents of a user-supplied file during parsing. If a malicious file is opened, the overflow can be exploited to execute arbitrary code in the context of the current process, leading to potential full system compromise.", "risk_and_exploitability": "Based on the description, it is inferred that the attack relies on a malicious file being opened by a legitimate user. The vulnerability has a CVSS score of 7.8, indicating high severity, but its EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The attack requires the attacker to supply a malicious file that a legitimate user opens, so the primary vector is local file import rather than remote access. Although the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, it remains a significant risk for exposed systems that process untrusted files."}}}}, "created": "2026-03-04T21:03:53.330131+00:00", "updated": "2026-04-16T13:45:21.952883+00:00", "vendors": ["deltaww", "deltaww$PRODUCT$cncsoft-g2"]}