Delta AS320T CVE-2026-1949

No special conditions - remote unauthenticated exploitation against default configurations of Delta AS320T web service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network reachability to the web management interface (typically TCP 80/443/8080) is the sole prerequisite. Exploitation does not require valid credentials, specific configuration settings, user interaction, or non-default features. The limiting factor is network accessibility: AS320T devices behind properly segmented OT networks with no internet exposure significantly reduce attack surface, though insider threats and supply chain compromise vectors remain. Stack-based overflows typically require knowledge of target architecture (x86, ARM, MIPS) and OS memory layout for reliable exploitation, but against embedded industrial devices with predictable configurations this barrier is low.

Real-world risk is CRITICAL for exposed OT environments despite absence of confirmed exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates: network-accessible attack surface requiring no authentication, low complexity (no race conditions or special timing), no user interaction, and complete compromise of confidentiality, integrity, and availability. Stack-based buffer overflows in web services are historically favored by ransomware operators targeting industrial systems (e.g., PIPEDREAM/INCONTROLLER frameworks). The vendor-specific advisory (Delta PCSA-2026-00006) covering four CVEs suggests active vulnerability research against this product line. EPSS data not available, but the combination of unauthenticated network vector, OT context, and memory corruption primitive elevates this above typical web application flaws. SSVC decision factors: exploitation status unknown but technical impact TOTAL (arbitrary code execution as web service user, likely root/SYSTEM in embedded systems). Primary concern is Shodan-discoverable internet-facing AS320T instances in critical infrastructure sectors.

An attacker scans industrial IP ranges (Shodan search: 'Delta AS320T') identifying exposed web management interfaces on port 80/443. They craft an HTTP PUT request with carefully constructed Content-Length header and payload designed to overflow the stack buffer during size calculation in the request handler. The overflow overwrites the saved return pointer with an address pointing to attacker-supplied shellcode in the request body, gaining arbitrary code execution in the context of the web service process (likely running with elevated privileges on the embedded system). The attacker establishes persistence, pivots to connected PLCs/RTUs on the OT network segment, and exfiltrates SCADA configurations or manipulates industrial processes.