CVE-2021-22672

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Delta Electronics' CNCSoft ScreenEditor in versions prior to v1.01.30 could allow the corruption of data, a denial-of-service condition, or code execution. The vulnerability may allow an attacker to remotely execute arbitrary code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	Delta Electronics CNCSoft ScreenEditor	CNCSoft ScreenEditor versions prior to v1.01.30

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-124-02Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-524/Third Party Advisory, VDB Entry
https://us-cert.cisa.gov/ics/advisories/icsa-21-124-02Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-21-524/Third Party Advisory, VDB Entry

Timeline

Published: May 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-226738.0The affected product is vulnerable to stack-based buffer overflow while processing over-the-air firmware updates from the CDN server, which CVE-2021-226746.5The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and dire CVE-2021-226757.2The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, which may allow an attack CVE-2021-226766.1UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScr CVE-2021-226777.8An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-serv CVE-2021-226787.8Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files. This could lead to memory CVE-2021-226799.8The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute cod CVE-2021-22688.1Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: Courseware). Supported versions that are affected are 12.CVE-2021-226809.8NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memor CVE-2021-226819.8Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix cont CVE-2021-226827.8Cscape (All versions prior to 9.90 SP4) is configured by default to be installed for all users, which allows full permissions, including rea CVE-2021-226837.8Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to cr