Delta AS320T EUVD-2026-25403

Remote network access to Delta AS320T device management interface without authentication required (CVSS PR:N confirms unauthenticated attack). The vulnerability is exploitable against default configurations exposing directory name processing functionality, likely through file management, configuration upload, or firmware update interfaces common in industrial control devices. No user interaction required (UI:N), meaning exploitation occurs through direct protocol manipulation rather than phishing or social engineering. Attack complexity is low (AC:L), indicating no race conditions, timing dependencies, or environmental variables need alignment. Exploitation is limited to scenarios where AS320T devices accept directory name input from network sources - air-gapped devices or those with disabled remote management features may not present exploitable attack surface. The unchanged scope (S:U) means exploitation remains contained within the AS320T device itself and does not inherently provide access to connected systems, though compromised servo drives could serve as pivot points in OT network lateral movement.

This vulnerability presents critical real-world risk despite absence of confirmed exploitation signals. The CVSS 9.8 score accurately reflects the worst-case technical impact: the AV:N vector means internet-exposed devices are vulnerable, AC:L indicates exploitation requires no special conditions or race conditions, PR:N confirms no authentication barrier, and UI:N means no social engineering is needed. The combination of S:U (unchanged scope) with C:H/I:H/A:H means attackers gain complete control of the vulnerable component. However, key risk signals are missing: no EPSS probability score is available to indicate likelihood of exploitation, no CISA KEV listing suggests active exploitation has not been observed, and no public POC availability is documented. The vulnerability affects industrial automation infrastructure where AS320T servo drives may be deployed in manufacturing, critical infrastructure, or building automation contexts. Real-world risk depends heavily on network exposure - devices on isolated OT networks face lower immediate risk than those accessible via IT networks or internet-facing HMI interfaces. Delta's self-disclosure through PCSA-2026-00006 suggests responsible disclosure, but the wildcard CPE version range creates uncertainty about whether all firmware versions are vulnerable or if older versions have implicit mitigations.

An attacker scans industrial networks for exposed Delta AS320T devices using Shodan or direct port scanning of common industrial protocols. Upon identifying an accessible AS320T management interface, the attacker crafts a malicious request containing a directory name exceeding the buffer size allocated in the vulnerable parsing function. The oversized directory name overwrites stack memory, corrupting the return address to redirect execution to attacker-controlled shellcode embedded within the malicious input. Since PR:N indicates no authentication is required, the attacker achieves remote code execution with the privileges of the AS320T process, potentially gaining full control of the servo drive system to disrupt manufacturing operations, modify motion control parameters, or pivot to other OT network devices.