Critical Buffer Overflow in Delta Electronics AS320T PLC

The National Vulnerability Database has issued a critical alert for CVE-2026-1951, impacting Delta Electronics AS320T programmable logic controllers (PLCs). This vulnerability, with a CVSS score of 9.8 (CRITICAL), stems from a lack of buffer length checking when handling directory names. Specifically, it’s categorized under CWE-121 (Stack-based Buffer Overflow).

This flaw allows an unauthenticated attacker to remotely execute arbitrary code on affected devices. The absence of length validation for directory names means a specially crafted input can overwrite adjacent memory, leading to system compromise. This isn’t just a denial-of-service risk; it’s full control over industrial control systems.

For defenders, this means potential compromise of operational technology (OT) environments. An attacker exploiting this could disrupt critical infrastructure, manipulate industrial processes, or establish persistent access within a facility. The implications for manufacturing, utilities, and other sectors relying on Delta PLCs are severe.