17
CVEs
6
Critical
11
High
0
KEV
0
PoC
17
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
11
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Diaenergie
86
Infrasuite Device Master
30
Cncsoft G2
16
Dialink
14
Dopsoft
13
Diascreen
12
Tpeditor
12
Cncsoft Screeneditor
10
Cncsoft
9
Delta Industrial Automation Dopsoft
7
Ispsoft
6
Cncsoft B
5
Wplsoft
5
Industrial
4
As320T
4
Asda Soft
4
Diaview
3
Screeneditor
3
Drasimucad
3
Dvp80Es3
3
Cnssoft Screeneditor
2
Devicenet Builder
2
Commgr2
2
Dvp 12Se
2
Dx 2100 L1 Cn Firmware
2
Dtmsoft
1
Industrial Automation Commgr
1
Dvp32Es200Re Firmware
1
Dx 2100L1 Cn Firmware
1
Dvp32Es200R Firmware
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-12578 | Arbitrary code execution in Delta Electronics DTMSoft arises from unsafe deserialization of untrusted data during project file parsing (CWE-502), allowing an attacker who supplies a malicious DTMSoft project file to run code in the context of the user who opens it. The flaw is local and requires victim interaction (opening the crafted file) rather than remote network exploitation, and impacts confidentiality, integrity, and availability fully. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; no EPSS score was supplied. | HIGH | 8.4 | 0.4% | 52 |
No patch
|
| CVE-2026-5726 | Stack-based buffer overflow in Delta Electronics ASDA-Soft allows local attackers with no privileges to execute arbitrary code by tricking users into opening a malicious file. The vulnerability achieves complete system compromise (confidentiality, integrity, availability all rated High in CVSS) through user interaction with crafted input. No public exploit identified at time of analysis, though the low attack complexity and lack of required privileges increase realistic exploitation risk once details emerge. | HIGH | 8.4 | 0.0% | 52 |
No patch
|
| CVE-2026-1950 | Remote code execution in Delta Electronics AS320T allows unauthenticated network attackers to exploit an unchecked buffer overflow in filename processing to execute arbitrary code with high impact to confidentiality, integrity, and availability. The CVSS 9.8 critical score reflects network-accessible attack surface with no authentication or user interaction required. No EPSS or KEV data available at time of analysis, but vendor advisory confirms multiple related vulnerabilities affecting the same product line. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-1952 | Remote unauthenticated attackers can trigger denial of service in Delta Electronics AS320T industrial automation devices by invoking an undocumented subfunction. The vulnerability allows network-accessible exploitation without credentials against default configurations, potentially disrupting critical industrial control operations. Delta Electronics confirmed the flaw in PCSA-2026-00006, grouped with three other CVEs affecting the same product line. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-1949 | Remote code execution in Delta Electronics AS320T industrial automation server allows unauthenticated network attackers to trigger memory corruption via malformed GET/PUT requests to the web service. The incorrect buffer size calculation (CWE-131) enables stack-based overflow attacks against network-exposed management interfaces. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) indicating trivial exploitation conditions and CRITICAL severity, this vulnerability represents an immediate risk to industrial control systems deploying this Delta OT product, though no public exploit or active exploitation confirmed at time of analysis. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-1951 | Unchecked directory name buffer in Delta Electronics AS320T enables remote code execution without authentication. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a remotely exploitable stack buffer overflow (CWE-121) requiring no user interaction or credentials. Delta Electronics disclosed this vulnerability in security advisory PCSA-2026-00006, affecting an industrial automation product. No EPSS score or KEV status available at time of analysis, but the trivial exploitation requirements (network accessible, no authentication, low complexity) present immediate risk to exposed AS320T devices. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-12819 | Unauthenticated Modbus TCP exposure on the Delta Electronics DVP12SE programmable logic controller lets any network-reachable attacker invoke security-sensitive PLC functions - reading and writing process registers, coils, and configuration - with no credentials or access control. The flaw (CWE-306, Missing Authentication for a Critical Function) carries a CVSS 4.0 base of 9.3 and is documented in Delta advisory PCSA-2026-00011 alongside CVE-2026-12818. There is no public exploit identified at time of analysis and no CISA KEV listing, but the Modbus protocol is trivially scriptable and well understood, lowering the practical exploitation bar. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-12818 | Resource exhaustion in Delta Electronics DVP12SE programmable logic controllers lets remote attackers crash or hang the device by overwhelming its Modbus TCP service, which lacks connection/resource throttling (CWE-770). Any host able to reach the PLC's Modbus TCP port can degrade or deny control of the affected industrial process. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated network attack surface makes it a meaningful availability risk in OT environments. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-78314 | SQL injection in Delta DIAEnergie versions up to and including v1.11.00.002 enables authenticated network-accessible attackers to escalate from data manipulation to remote code execution on the underlying host. Confirmed by vendor advisory Delta PCSA-2026-00015 and EUVD-2026-64759, the vulnerability (CWE-89) carries a CVSS 3.1 score of 8.8, reflecting low attack complexity and full CIA impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the RCE pathway in an energy management system warrants priority remediation. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-78315 | SQL Injection in Delta Electronics DIAEnergie versions up to and including 1.11.00.002 enables a low-privileged remote attacker to achieve full remote code execution on the underlying server. Confirmed by vendor advisory Delta-PCSA-2026-00015 and ENISA EUVD-2026-64760, the flaw (CWE-89) stems from unsanitized user input passed directly to backend SQL queries, with the database engine serving as the execution bridge to the OS. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible RCE impact in an industrial energy management context elevates this to a high-priority remediation target. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-78316 | SQL injection in Delta DIAEnergie versions up to and including v1.11.00.002 enables authenticated network-based attackers to achieve remote code execution on the underlying server. Carrying a CVSS base score of 8.8 with low-privilege, low-complexity network access required, this flaw poses serious risk to operational technology environments that depend on this energy management platform for monitoring and control. No public exploit code or CISA KEV listing has been identified at time of analysis, though Delta Electronics has self-disclosed the issue via vendor advisory PCSA-2026-00015. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-78317 | SQL injection in Delta DIAEnergie versions up to and including 1.11.00.002 enables low-privileged authenticated remote attackers to achieve full remote code execution on the host system. The flaw (CWE-89) is network-exploitable with low complexity, affecting an industrial energy management platform used in OT environments where RCE carries significant operational risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor has published a security advisory. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-12577 | Denial-of-service exposure in the Delta Electronics DVP80ES3 programmable logic controller (part of the DVP-ES3 series) stems from an improperly implemented standard security check (CWE-358) that a remote, unauthenticated attacker can abuse over the network to force a loss of availability. The CVSS 4.0 base score is 8.7 (High), driven entirely by high availability impact with no confidentiality or integrity impact in the scored vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the vendor's tags label this 'Information Disclosure,' which conflicts with the availability-only CVSS vector and should be verified against the Delta advisory. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-14193 | Denial-of-service in the Delta Electronics DVP80ES300T programmable logic controller allows remote unauthenticated attackers to crash the device by triggering an improper array-index validation flaw (CWE-129). Per the CVSS vector the impact is limited to availability (A:H) with no confidentiality or integrity loss, so a successful attack halts PLC operation rather than exposing data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-12575 | Denial of service in Delta Electronics DVP80ES3 programmable logic controllers arises from an improper resource shutdown or release flaw (CWE-404) that lets remote unauthenticated attackers exhaust or corrupt device resources. Per the CVSS vector the impact is limited to availability (A:H) with no confidentiality or integrity loss, meaning a successful attacker can crash or hang the PLC and disrupt the controlled industrial process. No public exploit identified at time of analysis; the issue is documented in Delta advisory Delta-PCSA-2026-00009, which bundles it with CVE-2026-12576 and CVE-2026-12577. | HIGH | 7.5 | 0.3% | 38 |
No patch
|