NVD Vulnerability Detail

CVE-2020-27287

Summary	Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code.
Publication Date	Jan. 12, 2021, 1:15 a.m.
Registration Date	Jan. 26, 2021, 11:56 a.m.
Last Update	Nov. 21, 2024, 2:20 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:deltaww:cncsoft-b::::::::			1.0.0.2

Related information, measures and tools

No	URL	タグ
1	https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04	Third Party Advisory US Government Resource
2	https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04	Third Party Advisory US Government Resource
3	https://www.zerodayinitiative.com/advisories/ZDI-21-030/	Third Party Advisory VDB Entry
4	https://www.zerodayinitiative.com/advisories/ZDI-21-030/	Third Party Advisory VDB Entry
5	https://www.zerodayinitiative.com/advisories/ZDI-21-031/	Third Party Advisory VDB Entry
6	https://www.zerodayinitiative.com/advisories/ZDI-21-031/	Third Party Advisory VDB Entry
7	https://www.zerodayinitiative.com/advisories/ZDI-21-041/	Third Party Advisory VDB Entry
8	https://www.zerodayinitiative.com/advisories/ZDI-21-041/	Third Party Advisory VDB Entry
9	https://www.zerodayinitiative.com/advisories/ZDI-21-043/	Third Party Advisory VDB Entry
10	https://www.zerodayinitiative.com/advisories/ZDI-21-043/	Third Party Advisory VDB Entry
11	https://www.zerodayinitiative.com/advisories/ZDI-21-044/	Third Party Advisory VDB Entry
12	https://www.zerodayinitiative.com/advisories/ZDI-21-044/	Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

Delta Electronics CNCSoft-B における境界外書き込みに関する脆弱性

Title	Delta Electronics CNCSoft-B における境界外書き込みに関する脆弱性
Summary	Delta Electronics CNCSoft-B には、境界外書き込みに関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 26, 2020, midnight
Registration Date	Sept. 14, 2021, 6:08 p.m.
Last Update	Sept. 14, 2021, 6:08 p.m.

Affected System

Delta Electronics, INC.

CNCSoft-B 1.0.0.2 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-27287	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27287
National Vulnerability Database (NVD)
2	CVE-2020-27287	https://nvd.nist.gov/vuln/detail/CVE-2020-27287

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-787	https://cwe.mitre.org/data/definitions/787.html

ベンダー情報

No	Name	URL
Delta
1	Top Page	https://www.deltaww.com/en-US/index

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-21-007-04	https://us-cert.cisa.gov/ics/advisories/icsa-21-007-04
JVN
2	JVNVU#97478563	http://jvn.jp/vu/JVNVU97478563/index.html
関連文書
3	ZDI-21-030 (Delta Industrial Automation CNCSoft-B DOPSoft XLS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability)	https://www.zerodayinitiative.com/advisories/ZDI-21-030/
4	ZDI-21-031 (Delta Industrial Automation CNCSoft-B DOPSoft XLS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability)	https://www.zerodayinitiative.com/advisories/ZDI-21-031/
5	ZDI-21-041 (Delta Industrial Automation CNCSoft-B DOPSoft XLS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability)	https://www.zerodayinitiative.com/advisories/ZDI-21-041/
6	ZDI-21-043 (Delta Industrial Automation CNCSoft-B DOPSoft XLS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability)	https://www.zerodayinitiative.com/advisories/ZDI-21-043/
7	ZDI-21-044 (Delta Industrial Automation CNCSoft-B DOPSoft XLS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability)	https://www.zerodayinitiative.com/advisories/ZDI-21-044/

Change Log

No	Changed Details	Date of change
1	[2021年09月14日] 掲載	Sept. 14, 2021, 6:08 p.m.