EUVD-2026-25396
GHSA-9rv5-7gpw-9g55
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service.
AnalysisAI
Remote code execution in Delta Electronics AS320T industrial automation server allows unauthenticated network attackers to trigger memory corruption via malformed GET/PUT requests to the web service. The incorrect buffer size calculation (CWE-131) enables stack-based overflow attacks against network-exposed management interfaces. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicating trivial exploitation conditions and CRITICAL severity, this vulnerability represents an immediate risk to industrial control systems deploying this Delta OT product, though no public exploit or active exploitation confirmed at time of analysis.
Technical ContextAI
The vulnerability stems from CWE-131 (Incorrect Calculation of Buffer Size), a memory safety flaw occurring in the web service component that processes HTTP GET and PUT requests. The AS320T is an industrial automation server manufactured by Delta Electronics (deltaww) commonly deployed in operational technology environments for SCADA/ICS applications. The stack-based buffer size miscalculation during request parsing means that attacker-controlled HTTP request data can overflow allocated memory boundaries. Unlike heap-based overflows, stack corruption can directly overwrite return addresses and function pointers, enabling immediate control flow hijacking. The affected CPE (cpe:2.3:a:deltaww:as320t) indicates platform-agnostic impact across all AS320T firmware versions prior to patch release.
RemediationAI
Apply vendor-released firmware update per Delta Electronics advisory PCSA-2026-00006 available at https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf - exact patched firmware version not specified in available data; consult advisory for download links and installation procedures. Until patching: isolate AS320T web interfaces from untrusted networks using firewall ACLs restricting TCP ports (typically 80/443/8080) to authorized management VLANs only, noting this breaks remote monitoring capabilities for distributed OT deployments; implement intrusion detection signatures for oversized or malformed HTTP GET/PUT requests with Content-Length mismatches or abnormal URI encoding; consider deploying reverse proxy with strict request validation as intermediary, though this adds architectural complexity and potential single point of failure in time-sensitive industrial processes. All mitigations reduce but do not eliminate risk given the unauthenticated network attack vector.
Remote code execution in Delta Electronics AS320T allows unauthenticated network attackers to exploit an unchecked buffe
Remote unauthenticated attackers can trigger denial of service in Delta Electronics AS320T industrial automation devices
Unchecked directory name buffer in Delta Electronics AS320T enables remote code execution without authentication. The CV
Same weakness CWE-131 – Incorrect Calculation of Buffer Size
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today