---METADATA---
VENDOR: Delta Electronics
PRODUCT: COMMGR2
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Delta Electronics COMMGR2 is affected by a stack-based buffer overflow vulnerability that could lead to arbitrary code execution or system crashes.

Executive Summary:
A critical stack-based buffer overflow in Delta Electronics COMMGR2 allows attackers to potentially execute arbitrary code or cause a total system denial-of-service.

Vulnerability Details

CVE-ID: CVE-2026-3630

Affected Software: Delta Electronics COMMGR2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a stack-based buffer overflow within the COMMGR2 software. While the authentication level is not explicitly defined in the brief, such flaws typically allow an attacker to overwrite memory by sending specially crafted data to a vulnerable function.

Business Impact

A successful exploit of this vulnerability could result in complete system compromise or significant operational downtime. With a CVSS score of 9.8, this is classified as Critical, indicating that the flaw is easily exploitable and carries a high risk of unauthorized remote code execution, which could lead to data theft or the introduction of ransomware into the industrial control environment.

Remediation Plan

Immediate Action: Update Delta Electronics COMMGR2 to the latest available version immediately to patch the buffer overflow flaw.

Proactive Monitoring: Implement network traffic analysis to detect unusual communication patterns or malformed packets directed at the COMMGR2 service.

Compensating Controls: Deploy host-based intrusion prevention systems (HIPS) and restrict network access to the software to authorized administrative workstations only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its critical severity, the potential for exploitation is extremely high once technical details become known.

Analyst Recommendation

The Critical severity of this vulnerability necessitates immediate attention from security teams. Organizations using Delta Electronics COMMGR2 should prioritize the application of the vendor-supplied patch to mitigate the risk of remote code execution and ensure the continued integrity of their control systems.

---METADATA---
VENDOR: Delta
PRODUCT: Electronics AS320T
AFFECTED_VERSIONS: 0 through 1.14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Delta Electronics AS320T is vulnerable to a denial-of-service attack via an undocumented subfunction.

Executive Summary:
An undocumented subfunction vulnerability in the Delta Electronics AS320T allows unauthenticated attackers to trigger a denial-of-service condition.

Vulnerability Details

CVE-ID: CVE-2026-1952

Affected Software: Delta Electronics AS320T

Affected Versions: 0 through 1.14

Vulnerability: This vulnerability involves the presence of hidden, undocumented functionality (CWE-912) that can be abused by an unauthenticated, remote attacker to cause a denial-of-service, disrupting device operations.

Business Impact

The exploitation of this flaw can result in significant operational disruption, as the device becomes unresponsive or enters a failed state. Given the CVSS score of 9.8, this vulnerability is critical, posing a severe risk to service availability and system uptime for industrial or network environments utilizing this hardware.

Remediation Plan

Immediate Action: Upgrade the device firmware to version 1.16 or later as specified in the vendor advisory.

Proactive Monitoring: Monitor device logs for unusual traffic patterns or unexpected service interruptions that may indicate attempts to trigger hidden functions.

Compensating Controls: Implement network segmentation to restrict access to the device management interfaces to only authorized administrative segments.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of 2026-04-24, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this an attractive target for automated exploitation tools.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to maintain system integrity. Administrators should prioritize upgrading the firmware on all affected Delta Electronics AS320T units to version 1.16 or higher to eliminate the risk associated with this undocumented subfunction.

---METADATA---
VENDOR: Delta
PRODUCT: Electronics AS320T
AFFECTED_VERSIONS: 0 through 1.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Delta Electronics AS320T directory name handling allows for potential remote code execution.

Executive Summary:
A critical stack-based buffer overflow in the Delta Electronics AS320T allows unauthenticated remote attackers to potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-1951

Affected Software: Delta Electronics AS320T

Affected Versions: 0 through 1.10

Vulnerability: The software fails to perform adequate bounds checking on directory names, leading to a stack-based buffer overflow (CWE-121). This vulnerability is exploitable by an unauthenticated attacker over the network.

Business Impact

Successful exploitation allows for complete system compromise, including potential unauthorized code execution, data theft, and persistent denial-of-service. With a CVSS score of 9.8, the impact is considered total, threatening the confidentiality, integrity, and availability of the affected system.

Remediation Plan

Immediate Action: Upgrade the device firmware to version 1.12 or later immediately to patch the buffer overflow vulnerability.

Proactive Monitoring: Review system logs for signs of memory corruption, unexpected process crashes, or unauthorized command execution.

Compensating Controls: Utilize a Web Application Firewall (WAF) or Network Intrusion Prevention System (NIPS) to filter malicious traffic containing oversized directory naming strings.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of 2026-04-24, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Stack-based buffer overflows of this nature are highly dangerous due to their potential for remote code execution.

Analyst Recommendation

Given the critical nature of this buffer overflow, immediate firmware remediation is required. Security teams must ensure that all AS320T devices are updated to at least version 1.12 to prevent potential remote exploitation of the directory handling mechanism.

---METADATA---
VENDOR: Delta
PRODUCT: Electronics AS320T
AFFECTED_VERSIONS: 0 through 1.14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Delta Electronics AS320T file name handling allows for potential remote code execution.

Executive Summary:
A critical stack-based buffer overflow in the Delta Electronics AS320T allows unauthenticated remote attackers to potentially execute arbitrary code via file name manipulation.

Vulnerability Details

CVE-ID: CVE-2026-1950

Affected Software: Delta Electronics AS320T

Affected Versions: 0 through 1.14

Vulnerability: The software fails to perform proper length validation on file name inputs, resulting in a stack-based buffer overflow (CWE-121). An unauthenticated attacker can exploit this flaw remotely to crash the system or execute arbitrary code.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating the highest level of urgency. Successful exploitation can lead to full system compromise, resulting in a total loss of control over the affected hardware and potential access to sensitive operational data.

Remediation Plan

Immediate Action: Upgrade the device firmware to version 1.16 or later as per the vendor's security instructions.

Proactive Monitoring: Monitor for abnormal process behavior or unexpected reboots that may indicate exploitation attempts targeting file system operations.

Compensating Controls: Deploy network-level traffic inspection to detect and block malformed packets containing excessively long file names before they reach the device.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of 2026-04-24, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw represents a significant risk due to its accessibility to remote, unauthenticated actors.

Analyst Recommendation

The risk posed by this buffer overflow is extreme, and it must be addressed with the highest priority. Administrators should proceed with firmware updates to version 1.16 immediately, ensuring that all devices are brought into a secure state to mitigate the threat of remote code execution.

---METADATA---
VENDOR: Delta Electronics
PRODUCT: AS320T
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Delta Electronics AS320T is vulnerable to a stack-based buffer overflow due to incorrect buffer size calculations in its web service's GET/PUT request handler.

Executive Summary:
A stack-based buffer overflow in the Delta Electronics AS320T web service creates a critical risk for remote code execution and system instability.

Vulnerability Details

CVE-ID: CVE-2026-1949

Affected Software: Delta Electronics AS320T

Affected Versions: See vendor advisory

Vulnerability: The web service fails to correctly calculate buffer sizes on the stack during the processing of GET/PUT requests. This allows an attacker to trigger a buffer overflow, potentially leading to arbitrary code execution or a crash of the service.

Business Impact

With a CVSS score of 9.8, this vulnerability is extremely dangerous, as it can allow an attacker to gain full control over the device. Potential impacts include unauthorized access to operational data, the deployment of malicious payloads, and critical system downtime, which is particularly severe in industrial environments.

Remediation Plan

Immediate Action: Update the firmware of the Delta Electronics AS320T to the latest version provided by the manufacturer.

Proactive Monitoring: Monitor for unexpected service crashes or restarts, which may indicate an exploitation attempt in progress.

Compensating Controls: Implement network-level filtering to restrict access to the web service, ensuring that only authorized traffic can reach the device.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 24, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Buffer overflows in critical service handlers are high-priority vulnerabilities that can lead to complete device compromise. Organizations must expedite the deployment of the provided patches and verify the integrity of the device configuration post-update.

Executive Summary:
A high-severity stack-based buffer overflow vulnerability has been identified in the COMMGR component of multiple Delta Electronics products. This flaw could allow a remote attacker to execute arbitrary code on an affected system by sending specially crafted data, potentially leading to a full system compromise and disruption of industrial control processes.

Vulnerability Details

CVE-ID: CVE-2025-53418

Affected Software: Delta Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability is a stack-based buffer overflow within the COMMGR software component. The application fails to properly validate the length of user-supplied input before copying it to a memory buffer on the stack. An unauthenticated remote attacker can exploit this by sending a request containing a payload larger than the buffer is designed to handle, causing the buffer to overflow and overwrite adjacent memory, including the function's return address. Successful exploitation allows the attacker to divert the program's execution flow and run arbitrary code with the privileges of the COMMGR service.

Business Impact

This is a high-severity vulnerability with a CVSS score of 8.6, posing a significant risk to operational technology (OT) environments. Successful exploitation could grant an attacker complete control over the affected device, leading to severe consequences such as the disruption or shutdown of critical industrial processes, unauthorized modification of system configurations, and theft of sensitive operational data. The potential for remote code execution could also enable an attacker to establish a persistent foothold in the network, leading to further lateral movement and broader system compromise.

Remediation Plan

Immediate Action: Apply vendor-supplied security updates immediately to patch the vulnerable COMMGR component across all affected systems. Concurrently, increase monitoring of network traffic to and from these devices, and review application and system logs for any anomalous activity or crash events that could indicate an exploitation attempt.

Proactive Monitoring: Implement network monitoring to detect and alert on unusually long or malformed data packets sent to the COMMGR service. System administrators should monitor for unexpected crashes or restarts of the service, as these can be indicators of failed exploitation attempts. Utilize an Intrusion Detection System (IDS) with signatures capable of identifying common buffer overflow attack patterns.

Compensating Controls: If immediate patching is not feasible, implement network segmentation to isolate vulnerable systems from untrusted networks, especially the internet. Use firewalls and Access Control Lists (ACLs) to restrict access to the affected service to only trusted IP addresses and authorized personnel. Deploying endpoint protection with exploit prevention capabilities can also help mitigate attempts to execute malicious code.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 26, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, stack-based buffer overflows are a well-understood vulnerability class, and threat actors could develop a functional exploit with relative ease.

Analyst Recommendation

Given the high CVSS score of 8.6 and the risk of remote code execution in sensitive industrial environments, organizations must treat this vulnerability with high urgency. The primary recommendation is to apply the vendor-provided patches to all affected Delta products without delay. Although this CVE is not currently on the CISA KEV list, its high severity and potential impact on critical infrastructure warrant immediate attention. If patching cannot be performed immediately, the compensating controls outlined above should be implemented as a temporary risk mitigation measure.

---METADATA---
VENDOR: Martcode Software Inc.
PRODUCT: Delta Course Automation
AFFECTED_VERSIONS: Through 04022026
---END_METADATA---

Description Summary:
Delta Course Automation is vulnerable to a critical SQL Injection flaw that allows attackers to manipulate database commands. The vendor has not responded to disclosure attempts.

Executive Summary:
A critical SQL Injection vulnerability in Delta Course Automation allows unauthenticated attackers to access, modify, or delete sensitive database information, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-5329

Affected Software: Delta Course Automation

Affected Versions: All versions through 04022026

Vulnerability: The application fails to properly neutralize special elements in SQL commands, resulting in a classic SQL Injection (SQLi) vulnerability. This allows an unauthenticated attacker to execute arbitrary SQL queries against the backend database.

Business Impact

With a CVSS score of 9.8, the impact is severe. An attacker can steal student records, financial data, and administrative credentials. Furthermore, depending on the database configuration, SQL injection can sometimes be escalated to full remote code execution on the database server.

Remediation Plan

Immediate Action: Since the vendor has not responded, administrators should immediately apply a Web Application Firewall (WAF) with strict SQLi protection rules to shield the application.

Proactive Monitoring: Closely monitor database logs for anomalous queries, rapid data exfiltration patterns, or unauthorized administrative account creation.

Compensating Controls: Implement the principle of least privilege for the database user account and ensure the application is not running with DBA or root permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 4, 2026, there is no public information indicating active exploitation. However, the vendor's lack of response increases the risk, as no official patch may be forthcoming in the near term.

Analyst Recommendation

The lack of a vendor patch makes this a high-risk situation. Organizations must rely on robust perimeter defenses like WAFs and should consider migrating to a supported platform if the vendor remains unresponsive to security disclosures.