Delta AS228T CVE-2026-12579

Exploitation requires network-level reachability to the AS228T controller's management or communication interface and does not require valid credentials or user interaction (PR:N/UI:N), reflecting the CWE-288 alternate-path bypass. The key limiting factor is the high attack complexity (AC:H): the attacker must meet conditions outside their direct control - the terse advisory does not name the exact configuration or state, so the precise precondition must be verified in Delta PCSA-2026-00012. In practice, exploitation is further gated by OT network exposure, since a properly segmented PLC on an isolated control network is not reachable by a remote attacker.

The signals are mixed and lean toward a moderate, not urgent, priority. The CVSS vector shows a network attack vector with no privileges or user interaction required (AV:N/PR:N/UI:N), which is serious, but the high attack complexity (AC:H) indicates the attacker must satisfy conditions outside their control - such as timing, specific state, or reconnaissance - making reliable exploitation harder. Impact is meaningful for OT (I:H/A:H: an attacker could manipulate or disrupt the controller) but confidentiality is untouched (C:N). No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is not in CISA KEV and no POC is referenced, so there is no evidence of active or imminent exploitation. The dominant real-world limiting factor is exposure: PLCs should sit on isolated OT networks, so network reachability - not the CVSS score alone - determines actual risk. Note the AC:H rating is not explained by the terse description, so the precise preconditions should be verified against Delta advisory PCSA-2026-00012.

An attacker with network reachability to the AS228T - for example after pivoting from an IT network into a poorly segmented OT segment - sends crafted requests to the controller's management or communication interface using the alternate path that bypasses authentication, then modifies control logic or forces an unsafe operating state. Achieving this reliably requires satisfying the high-complexity preconditions in the CVSS vector, and no public proof-of-concept was identified at the time of analysis.