CVE-2024-1941 is a high severity (CVSS 7.8) stack based buffer overflow in Delta Electronics CNCSoft-B, versions 1.0.0.4 and prior. It may allow arbitrary code execution. Delta's fix is a CNCSoft-B build with an issue date of 2024-01-23 or later. Check which build you have.
What's affected
CISA advisory ICSA-24-060-01, released 29 February 2024, lists CNCSoft-B versions 1.0.0.4 and prior as affected. NVD matches that.
There is a wrinkle in the version wording. The advisory's mitigation tells users to update to CNCSoft-B V 1.0.0.4 with an issue date of 2024-01-23 or later, while the affected list says 1.0.0.4 and prior. The same version number is therefore both affected and the fix, distinguished only by build date. Check the build date, and ask Delta if it is unclear.
Both NVD and CISA give 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so the severity sources agree.
How to check if you're exposed
CNCSoft-B is engineering software that runs on a Windows workstation, so look at the programs list on engineering and maintenance machines. Read the version and build date from the application's About information, and compare with the 2024-01-23 issue date.
The attack vector is local and needs user interaction, so the realistic path is a person on the workstation opening a malicious project or file. List who can bring files to those machines and by what route, such as email, shared drives or removable media.
What to do now
- Find every workstation with CNCSoft-B installed.
- Check the build date and install the Delta build issued 2024-01-23 or later.
- Contact Delta Electronics if the version and date wording is unclear for your installation.
- Follow CISA's guidance: keep control system devices off the internet and behind firewalls, isolated from business networks.
- Restrict who can open files from outside sources on engineering workstations.
Why it matters
The record lists CWE-121 (stack based buffer overflow) and CWE-787 (out of bounds write). The program copies more data into a fixed size stack buffer than it can hold, overwriting adjacent memory. With a crafted input that can redirect execution.
Offline engineering tools are a common blind spot. They sit near production equipment, often run with wide rights and rarely appear in the patching cycle of the corporate fleet. A crafted project file delivered by email or USB is enough. CISA names Critical Manufacturing as the affected sector and credits a researcher working with the Trend Micro Zero Day Initiative. The KEV flag is false and CISA does not report exploitation of this issue. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Quick check
Is this remotely exploitable?
The CVSS vector is local with user interaction. An attacker needs a user to open crafted input on the machine.
Why is the fixed version the same number as the affected one?
The advisory distinguishes them by issue date. Use the build dated 2024-01-23 or later, and confirm with Delta.
Sources
Last reviewed: 19 October 2026.
