Critical RCE in Delta Electronics AS320T Industrial Controllers

The National Vulnerability Database has issued a critical advisory for CVE-2026-1949, affecting Delta Electronics AS320T industrial controllers. This vulnerability stems from an incorrect calculation of buffer size on the stack within the web service’s GET/PUT request handler. With a CVSS score of 9.8, this flaw is highly severe, making these devices ripe for remote exploitation.

This isn’t just a bug; it’s a direct path to full system compromise. The attacker’s calculus here is simple: unauthenticated remote code execution (RCE) on critical infrastructure, often internet-exposed. The AV:N/AC:L/PR:N/UI:N vector means an attacker needs no prior access, no complex techniques, and no user interaction. This is as bad as it gets for exposed operational technology (OT).

For defenders, the implication is clear: unpatched AS320T devices are wide open. This vulnerability, categorized as CWE-131 (Incorrect Calculation of Buffer Size), allows an attacker to inject and execute arbitrary code, taking full control of industrial processes. This can lead to disruption, data manipulation, or even physical damage, depending on the controlled environment.