CVE-2026-1950
Published: 24 April 2026
Summary
CVE-2026-1950 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Deltaww As320T Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-1950 is a stack-based buffer overflow vulnerability (CWE-121) in Delta Electronics AS320T, caused by a lack of length checking for the buffer handling file names. Published on 2026-04-24, it affects this specific industrial control system component and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical severity.
A remote attacker requires no privileges or user interaction and can exploit the vulnerability over the network with low attack complexity. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system disruption on the affected AS320T device.
Delta Electronics has published security advisory PCSA-2026-00006, which covers CVE-2026-1950 alongside related vulnerabilities CVE-2026-1949, 1951, and 1952 in the AS320T. The advisory is available at https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25402
Vulnerability details
Delta Electronics AS320T has No checking of the length of the buffer with the file name vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated stack buffer overflow enabling arbitrary code execution on a public-facing ICS device directly maps to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of file name inputs, including length checks, to directly prevent stack-based buffer overflows from insufficient bounds checking.
Requires identification, reporting, and correction of flaws like this buffer overflow vulnerability through timely patching as per the vendor advisory.
Implements memory safeguards such as non-executable stacks and address randomization to mitigate exploitation of stack-based buffer overflows even if input validation fails.