EUVD-2026-25404
GHSA-598w-79v9-4m2g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessNetwork scan identifies AS320T
-
ExploitCraft packet invoking undocumented subfunction
-
ExecutionTrigger resource exhaustion or crash
-
ImpactService denial disrupts industrial process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hidden functionality detection
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Delta AS320T devices. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms network accessibility without authentication, privilege requirements, or user interaction. Exploitation requires only network reachability to the AS320T management or operational interface where the undocumented subfunction is exposed. As an industrial control device, AS320T units deployed with internet-facing interfaces or accessible from corporate IT networks (lacking OT segmentation) are immediately at risk. The hidden nature of the vulnerable subfunction (CWE-912) means defenders may not be aware of this attack surface through normal product documentation review. |
| Impact | High real-world risk for industrial environments. CVSS 9.8 reflects maximum severity across all metrics: network vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with impact to all CIA triad elements rated High. The hidden functionality (CWE-912) suggests the attack surface may not be evident during standard security reviews. EPSS data not provided but KEV status not indicated, suggesting no confirmed widespread exploitation campaigns at time of analysis. However, the confluence of critical CVSS, industrial target (OT/ICS environment where availability is paramount), and vendor acknowledgment (Delta PCSA-2026-00006) elevates priority. Industrial control device vulnerabilities often see delayed but targeted exploitation once details are public. The grouping with three other CVEs (CVE-2026-1949, 1950, 1951) in the same advisory suggests systemic security issues requiring urgent vendor engagement. |
| Exploit ScenarioDerived | An attacker scans industrial network ranges identifying Delta AS320T devices via banner grabbing or protocol fingerprinting. They send crafted packets invoking the undocumented subfunction over the network interface, triggering resource exhaustion or crash conditions. The device becomes unresponsive, halting connected automation processes and requiring manual intervention to restore operations, causing production downtime in manufacturing or critical infrastructure environments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 24, 2026
Remote unauthenticated attackers can trigger denial of service in Delta Electronics AS320T industrial automation devices by invoking an undocumented subfunction. The vulnerability allows network-accessible exploitation without credentials against default configurations, potentially disrupting critical industrial control operations. Delta Electronics confirmed the flaw in PCSA-2026-00006, grouped with three other CVEs affecting the same product line.
RemediationAI
Consult Delta Electronics advisory PCSA-2026-00006 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf) for patched firmware versions and upgrade instructions - vendor-released patches not independently confirmed from available data. Until patching, implement network segmentation to isolate AS320T devices on dedicated OT VLANs with no direct internet exposure, enforcing strict firewall rules permitting only authorized source IPs to management interfaces (note: reduces operational flexibility for remote monitoring). Deploy industrial protocol inspection at the network perimeter to detect abnormal subfunction invocations if protocol specifications are known (requires Deep Packet Inspection capability and AS320T protocol knowledge). Monitor device logs for unexpected service restarts or availability gaps indicating exploitation attempts. Given CWE-912 (hidden functionality), also review vendor documentation for any mention of debug/maintenance modes that should be disabled in production deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The AS320T is a Delta Electronics industrial automation product (CPE: cpe:2.3:a:deltaww:as320t). The vulnerability stems from CWE-912 (Hidden Functionality), indicating the presence of undocumented or debug subfunctions in the device's network interface that lack proper access controls. These hidden features, likely intended for testing or maintenance, expose attack surface to unauthorized network actors. Industrial control devices frequently contain such residual functionality that bypasses normal authentication and authorization mechanisms, creating a critical weakness when internet-facing or accessible from untrusted networks.
Know when As320T gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.
Executive ViewAI
CVE-2026-1952 is a critical remote denial-of-service vulnerability affecting Delta Electronics AS320T industrial automation devices, allowing unauthenticated network attackers to disrupt operations without credentials. Organizations relying on these controllers for critical infrastructure or manufacturing processes face immediate risk of operational downtime; the lack of available patches requires urgent mitigation deployment.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-restrict AS320T access to dedicated, air-gapped control networks; (2) Firewall rules-block all unnecessary inbound access to AS320T management and operational ports; (3) IDS/IPS deployment-monitor for exploitation signatures targeting undocumented subfunction invocation; (4) Access logging-enable device-level logging and SIEM alerting for connection attempts; (5) Redundancy-deploy failover systems to minimize downtime risk from DoS events; (6) Vendor contact-engage Delta Electronics for private vulnerability details and custom detection indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Delta Electronics AS320T allows unauthenticated network attackers to exploit an unchecked buffe
Remote code execution in Delta Electronics AS320T industrial automation server allows unauthenticated network attackers
Unchecked directory name buffer in Delta Electronics AS320T enables remote code execution without authentication. The CV
Exploit-DB