CVE-2026-1949

Deltaww As320T Firmware ≤ 1.16

Published

24 April 2026

Modified

11 May 2026

Patch / advisory

View advisory

CVSS Score v3.1 9.8

Click a component to see what it means

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0061 46th percentile

Risk Priority 72 floored blend · peak EPSS

Summary

CVE-2026-1949 is a critical-severity Incorrect Calculation of Buffer Size (CWE-131) vulnerability in Deltaww As320T Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-1949 affects Delta Electronics AS320T, where the GET/PUT request handler in the web service performs an incorrect calculation of the buffer size on the stack. This flaw, tied to CWE-131 (Incorrect Calculation of Buffer Size), was published on 2026-04-24 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

Remote attackers require only network access to exploit this vulnerability, with low attack complexity, no authentication privileges, and no user interaction needed. Exploitation via crafted GET or PUT requests to the web service can lead to high confidentiality, integrity, and availability impacts, likely enabling arbitrary code execution through stack-based buffer overflow.

Delta Electronics advisory PCSA-2026-00006 addresses CVE-2026-1949 alongside related vulnerabilities (CVE-2026-1950, 1951, 1952) in AS320T, providing details on mitigations; the document is available at https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-25396

Vulnerability Data

Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service.

CWE(s): CWE-131

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

T1212 Exploitation for Credential Access Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-1950Same product: Deltaww As320T

CVE-2026-1951Same product: Deltaww As320T

CVE-2026-1952Same product: Deltaww As320T

CVE-2025-58319Same vendor: Deltaww

CVE-2024-12836Same vendor: Deltaww

CVE-2025-22880Same vendor: Deltaww

CVE-2025-62580Same vendor: Deltaww

CVE-2025-22881Same vendor: Deltaww

CVE-2023-0250Same vendor: Deltaww

CVE-2025-62579Same vendor: Deltaww

Affected Assets

deltaww

as320t firmware

≤ 1.16

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer security testing and code review can discover incorrect buffer-size computations before deployment.

SA-8 Security and Privacy Engineering Principles partial match

Secure engineering principles directly require correct buffer-size arithmetic and bounds-checked allocation.

SI-10 Information Input Validation partial match

Input validation can enforce that supplied lengths or counts used in size calculations are within safe bounds.

SI-16 Memory Protection partial match

Memory-protection mechanisms limit the exploitability of an overflow that results from an incorrect size calculation.

SI-2 Flaw Remediation partial match

Flaw-remediation processes that include vulnerability scanning or static analysis will surface buffer-size errors.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match

prevents

Secure SDLC practices directly prevent buffer-size miscalculations via coding standards, reviews, and testing, while fixing this single weakness only partially fulfills the broader control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.28 Secure coding mostly match

degrades

Secure coding standards directly require correct buffer-size calculations.

A.8.29 Security testing in development and acceptance mostly match

finds

Security testing can detect buffer-size errors before release.

A.8.25 Secure development life cycle partial match

prevents

Secure development lifecycle mandates size-checking practices that reduce buffer-size miscalculations.

A.8.26 Application security requirements partial match

prevents

Application security requirements can specify buffer-size validation rules.