PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-1949 Deltaww CVE debrief

CVE-2026-1949 is a critical vulnerability in Delta Electronics AS320T firmware affecting the web service GET/PUT request handler. The issue is an incorrect calculation of stack buffer size, which can have high impact because the published CVSS vector rates the flaw as network-reachable, unauthenticated, and capable of affecting confidentiality, integrity, and availability. NVD lists firmware versions before 1.16 as vulnerable, and Delta’s advisory covers this issue alongside related AS320T vulnerabilities.

Vendor
Deltaww
Product
CVE-2026-1949
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-24
Original CVE updated
2026-05-11
Advisory published
2026-04-24
Advisory updated
2026-05-11

Who should care

OT/ICS defenders, plant operators, and system integrators who manage Delta Electronics AS320T devices, especially any unit running firmware earlier than 1.16.

Technical summary

The flaw is a stack buffer sizing error in the AS320T web service GET/PUT request handler. NVD maps the weakness to CWE-131 and rates the issue CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a remotely reachable issue with no privileges or user interaction required. The NVD CPE data marks AS320T firmware versions before 1.16 as affected.

Defensive priority

Immediate. Treat as a critical exposure on any internet- or network-reachable AS320T management interface and prioritize firmware remediation ahead of routine maintenance.

Recommended defensive actions

  • Identify all Delta Electronics AS320T devices in the environment and confirm their firmware version.
  • Prioritize devices running firmware earlier than 1.16 for immediate remediation.
  • Apply the vendor-recommended firmware update or move to a non-vulnerable version at or above 1.16.
  • Restrict access to the web service management interface to trusted admin networks only until remediation is complete.
  • Monitor vendor advisory materials for any additional guidance related to the AS320T vulnerability set.

Evidence notes

Primary evidence comes from the NVD record for CVE-2026-1949 and the linked Delta Electronics advisory. The NVD entry shows publication on 2026-04-24 and modification on 2026-05-11, lists CWE-131, and marks AS320T firmware versions before 1.16 as vulnerable. The vendor advisory referenced by NVD is titled for multiple AS320T vulnerabilities including CVE-2026-1949.

Official resources

Publicly disclosed on 2026-04-24 via the NVD record, with a linked Delta Electronics advisory. NVD modified the record on 2026-05-11.