Delta Electronics AS320T Plagued by Critical DoS Vulnerability

The National Vulnerability Database (NVD) has detailed CVE-2026-1952, a critical denial-of-service (DoS) vulnerability impacting Delta Electronics AS320T programmable logic controllers (PLCs). This flaw, stemming from an undocumented subfunction, carries a CVSSv3 score of 9.8, indicating maximum severity. Attackers can exploit this remotely without authentication, making it a severe threat to operational technology (OT) environments.

This isn’t just a crash; it’s a critical disruption. The ability to trigger a DoS via an undocumented subfunction means an attacker can halt industrial processes, leading to significant operational downtime and potential safety hazards. The lack of authentication required for exploitation dramatically lowers the barrier for entry for malicious actors, from opportunistic script kiddies to state-sponsored groups looking to disrupt critical infrastructure.

CISOs in manufacturing and industrial sectors must treat this as an immediate priority. The attacker’s calculus here is simple: maximum impact with minimal effort. Disabling PLCs can cascade into widespread production stoppages, making this a prime target for extortion or sabotage. Defenders need to isolate these systems and apply vendor patches immediately.