What is the CVSS score of EUVD-2026-40910?

EUVD-2026-40910 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Delta AS228T are affected by EUVD-2026-40910?

Delta Electronics AS228T programmable logic controllers contain a remote authentication bypass vulnerability (CVE-2026-12579) that could allow attackers to directly access and manipulate critical…

How to fix or mitigate EUVD-2026-40910?

Within 24 hours: Identify and inventory all AS228T controllers in production; assess network accessibility and document their criticality. Within 7 days: Contact Delta Electronics to confirm applicability to your deployed models and request interim guidance; implement firewall rules restricting network access to AS228T devices to authorized management networks only. Within 30 days: Deploy network segmentation to isolate affected controllers from untrusted networks; establish continuous monitoring; monitor Delta Electronics security advisories for patch release.

Delta AS228T EUVD-2026-40910

| CVE-2026-12579 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-01 Deltaww

GHSA-3chc-mhxc-xprf

Authentication Bypass As228T Deltaww

7.4

CVSS 3.1 · Vendor: Deltaww

Severity by source

Vendor (Deltaww) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

7.4 HIGH

Network-reachable unauthenticated bypass (AV:N/PR:N) but non-trivial preconditions justify AC:H; controller manipulation gives I:H/A:H with no data disclosure (C:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Deltaww).

CVSS VectorVendor: Deltaww

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 07:15 vuln.today

DescriptionCVE.org

AS228T with Authentication Bypass Vulnerability

AnalysisAI

Authentication bypass in the Delta Electronics AS228T programmable logic controller allows remote attackers to circumvent authentication controls and gain unauthorized access to controller functions over the network, threatening the integrity and availability of the industrial process it governs. The CVSS 3.1 base score is 7.4 (High), driven by high integrity and availability impact (I:H/A:H) with no confidentiality loss, but tempered by high attack complexity (AC:H). At the time of analysis there is no public exploit identified and the flaw is not listed in CISA KEV; no EPSS value was supplied.

Technical ContextAI

The AS228T is a CPU/controller module in Delta Electronics' AS-series compact PLC line, used in operational-technology (OT) environments for machine and process automation. The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning an attacker can reach protected controller functionality through a route that skips the intended authentication check rather than by defeating credentials directly. Because PLCs directly drive physical actuators and read sensors, a bypass at the authentication layer translates into the ability to alter control logic or operating state. The single affected CPE, cpe:2.3:a:deltaww:as228t:*:*:*:*:*:*:*:*, scopes the issue to the AS228T product with the version left unspecified in the provided data.

RemediationAI

Consult Delta advisory PCSA-2026-00012 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00012_AS228T%20Authentication%20Bypass%20Vulnerability%20(CVE-2026-12579).pdf) for the fixed firmware version and apply the vendor update to affected AS228T units; an exact patched version was not present in the provided data, so treat the advisory as authoritative before scheduling the upgrade. Because this is an OT device where patching may require a maintenance window, apply compensating network controls in the interim: place the PLC behind an OT firewall or data diode and block untrusted access to its engineering/communication ports (commonly Modbus TCP 502 and Delta's proprietary programming service), restrict management access to a dedicated engineering VLAN or jump host, and disable any remote-programming or web management interface that is not operationally required. The trade-off is that tightening network segmentation and disabling remote engineering access can hinder legitimate remote maintenance and SCADA polling, so validate control-system communication paths before enforcing the restrictions.