CVE-2026-1361 Delta Electronics CVE debrief

Who should care

Organizations that use ASDA-Soft on engineering workstations or other OT/industrial control endpoints should prioritize this advisory, especially teams responsible for patching, workstation hardening, and control-system network segregation.

Technical summary

The supplied advisory describes a stack-based buffer overflow in ASDA_Soft 7.2.0.0 triggered during parsing of .par files. The root cause is improper bounds checking on a user-controlled size parameter, which can permit out-of-bounds writes on the stack. The supplied CVSS vector rates the issue as high severity (CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating local attack conditions with user interaction required.

Defensive priority

High. This is a high-severity memory corruption issue in industrial software, and Delta has already provided a fixed release. For exposed or operationally important ASDA-Soft deployments, patching should be treated as a near-term priority.

Recommended defensive actions

• Upgrade ASDA-Soft to v7.2.2.0 or later, as identified by Delta Electronics.
• Review Delta advisory Delta-PCSA-2026-00003 and apply any vendor-provided compensating controls.
• Restrict ASDA-Soft use to trusted operators and limit exposure of engineering workstations that process .par files.
• Keep control-system networks and remote devices behind firewalls, and isolate them from the business network.
• Use VPN-based remote access rather than direct Internet exposure for OT environments.
• Follow CISA industrial control system best practices for patching, segmentation, and defense in depth.

Evidence notes

All material claims in this debrief are drawn from the supplied CISA CSAF advisory record for ICSA-26-048-02, the embedded Delta remediation notes, and the provided CVSS vector. The source set identifies the affected product as Delta Electronics ASDA-Soft version 7.2.0.0, the fixed release as v7.2.2.0, and includes general ICS defensive guidance. The supplied enrichment marks this as not in CISA KEV, with no ransomware-campaign attribution provided.

Official resources