CVE-2024-1595 is a high severity (CVSS 7.8) uncontrolled search path flaw in Delta Electronics CNCSoft-B and DOPSoft that allows DLL hijacking and system takeover. CISA lists DOPSoft versions prior to 4.0.0.82 as affected, and CNCSoft-B v1.0.0.4. Update DOPSoft to 4.0.0.82 or later.
What's affected
CISA advisory ICSA-24-053-01 lists these affected products:
- CNCSoft-B v1.0.0.4
- DOPSoft versions prior to v4.0.0.82
The NVD record names DOPSoft prior to 4.0.0.82 in its description and lists both products in its product data. CISA scores it 7.8 with a local attack vector, matching the record. For CNCSoft-B, the advisory text I read names the version but I did not confirm a fixed build, so check the vendor and CISA advisory.
How to check if you're exposed
On the engineering workstation, open Programs and Features, find DOPSoft and CNCSoft-B, and read the version. DOPSoft below 4.0.0.82 is affected.
Also check the directories these tools load libraries from for write access by non-administrators, because the weakness depends on who can place files there.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Find workstations with DOPSoft and CNCSoft-B installed.
- Update DOPSoft to 4.0.0.82 or later.
- Follow Delta's guidance for CNCSoft-B in the CISA advisory.
- Restrict write access to application folders to administrators.
- Keep engineering workstations off the general office network.
Why it matters
The record classes this as CWE-427, uncontrolled search path element. When the program asks for a library by name, Windows searches several locations in order, and a malicious library placed in an earlier location is loaded in place of the real one.
The attack is local and needs a way to place a file, so the main concern is shared engineering machines and untrusted download folders. Industrial software often runs with high rights. The record's KEV flag is false. A practical control is to run engineering tools from a standard account and install them in folders that only administrators can change, which removes the easiest place to plant a library. Check any shared jump hosts for the same tools, because one user's planted file can run for the next user who opens the software.
Quick check
Is it remotely exploitable?
CISA's vector is local. The attacker needs to place a file on the machine.
Which DOPSoft build is fixed?
4.0.0.82 or later.
Sources
Last reviewed: 19 October 2026.
