Delta CNCSoft-G2 out-of-bounds write allows code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Out-of-bounds write in Delta CNCSoft-G2 file parser allows arbitrary code execution via malicious DPAX files; update to v2.1.0.27.
Delta Electronics CNCSoft-G2 versions 2.1.0.20 and prior contain an out-of-bounds write vulnerability (CVE-2025-47728) in DPAX file parsing that allows attackers to execute arbitrary code on affected systems. The vulnerability requires user interaction—a victim must open a malicious DPAX file or visit a malicious page—but once triggered, permits memory corruption and code execution in the context of the current process. CVSS v4 score is 8.5 (CVSS v3.1: 7.8). CNCSoft-G2 is used in critical manufacturing and energy sectors globally; this is not remotely exploitable.
Delta has released version 2.1.0.27 as a fix. CISA reports no known public exploitation in the wild at the time of this advisory. Defenders should apply the patch promptly, enforce network segmentation to isolate CNCSoft-G2 systems from the internet and business network, and implement access controls. User awareness training on avoiding malicious files and links is essential, as successful exploitation depends on social engineering.
Mentioned in this report
Detection guidance
Delta CNCSoft-G2 Spawning Shell or Script Interpreter
CNCSoft-G2 spawning a command shell, script host or LOLBin, a likely sign of code execution after a malicious DPAX file (CVE-2025-47728) is opened. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Delta CNCSoft-G2 Spawning Shell or Script Interpreter
id: b968c35d-17a0-5fd3-a070-79a597c8a74f
status: experimental
description: Detects CNCSoft-G2 engineering software spawning a command shell, script
host or common living-off-the-land binary. Engineering software of this kind does
not normally launch these, so a child process suggests code execution after memory
corruption from a malicious DPAX file (CVE-2025-47728). Matches the parent/child
relation, not a specific payload.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-04
tags:
- attack.execution
- attack.t1204.002
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: CNCSoft
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \curl.exe
condition: selection_parent and selection_child
falsepositives:
- Vendor update or installer helpers launched from CNCSoft-G2 that call cmd.exe
- Engineers running custom post-build scripts triggered from the CNCSoft-G2 interface
level: high
author: Vorant
Delta CNCSoft-G2 Opening DPAX File From User-Writable Download Location
CNCSoft-G2 launched with a .dpax file from a download, temp or email cache path, the delivery pattern needed to trigger CVE-2025-47728. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Delta CNCSoft-G2 Opening DPAX File From User-Writable Download Location
id: aeadd21c-8cfd-58d0-9b95-fa2d1ba4fc7b
status: experimental
description: Detects a CNCSoft-G2 process started with a .dpax project file located
in a browser download, temp or mail attachment cache path. Exploiting CVE-2025-47728
requires the victim to open a malicious DPAX file, which is often delivered this
way. Context rule for triage; correlate with child process activity.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-04
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|contains: CNCSoft
selection_file:
CommandLine|contains: .dpax
selection_path:
CommandLine|contains:
- \Downloads\
- \AppData\Local\Temp\
- \INetCache\
- \Content.Outlook\
condition: selection_image and selection_file and selection_path
falsepositives:
- Engineers legitimately opening project files received from colleagues or vendors
and saved to Downloads
- Project files extracted from zip archives into the temp directory
level: low
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-04
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs