Search
Find a vulnerability
Search criteria
716 vulnerabilities by DeltaWW
CVE-2026-12577 (GCVE-0-2026-12577)
Vulnerability from nvd – Published: 2026-07-01 07:05 – Updated: 2026-07-01 12:35
VLAI
EPSS
VEX
Title
DVP80ES3 Improperly Implemented Security Check for Standard vulnerability
Summary
DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-358 - Improperly Implemented Security Check for Standard
Assigner
References
1 reference
Impacted products
Date Public
2026-07-01 06:43
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12577",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T12:34:42.567445Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T12:35:02.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP80ES3",
"vendor": "deltaww",
"versions": [
{
"lessThanOrEqual": "1.08.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dvp80es3:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.08.10",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Qian Zou, Ke Xu, Xuewei Feng, Qi Li, Xueying Li, and Gang Jin from Zhongguancun Laboratory"
}
],
"datePublic": "2026-07-01T06:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability."
}
],
"value": "DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-596",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-596: TCP RST Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-358",
"description": "CWE-358: Improperly Implemented Security Check for Standard",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T07:05:25.146Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00009_DVP80ES3%20Multiple%20Vulnerabilities_v1%20(CVE-2026-12575,%2012576,%2012577).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to update the device firmware to v01.10.00 or later."
}
],
"value": "Users are recommended to update the device firmware to v01.10.00 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP80ES3 Improperly Implemented Security Check for Standard vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12577",
"datePublished": "2026-07-01T07:05:25.146Z",
"dateReserved": "2026-06-18T05:22:55.191Z",
"dateUpdated": "2026-07-01T12:35:02.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12576 (GCVE-0-2026-12576)
Vulnerability from nvd – Published: 2026-07-01 07:01 – Updated: 2026-07-01 12:21
VLAI
EPSS
VEX
Title
DVP80ES3 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability
Summary
DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-924 - Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Assigner
References
1 reference
Impacted products
Date Public
2026-07-01 06:43
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12576",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T12:21:21.101697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T12:21:28.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP80ES3",
"vendor": "deltaww",
"versions": [
{
"lessThanOrEqual": "1.06.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dvp80es3:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.06.00",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Qian Zou, Ke Xu, Xuewei Feng, Qi Li, Xueying Li, and Gang Jin from Zhongguancun Laboratory"
}
],
"datePublic": "2026-07-01T06:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability."
}
],
"value": "DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-596",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-596: TCP RST Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-924",
"description": "CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T07:01:17.903Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00009_DVP80ES3%20Multiple%20Vulnerabilities_v1%20(CVE-2026-12575,%2012576,%2012577).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to update the device firmware to v01.08.10 or later."
}
],
"value": "Users are recommended to update the device firmware to v01.08.10 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP80ES3 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12576",
"datePublished": "2026-07-01T07:01:17.903Z",
"dateReserved": "2026-06-18T05:22:53.986Z",
"dateUpdated": "2026-07-01T12:21:28.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12575 (GCVE-0-2026-12575)
Vulnerability from nvd – Published: 2026-07-01 06:55 – Updated: 2026-07-01 12:22
VLAI
EPSS
VEX
Title
DVP80ES3 Improper Resource Shutdown or Release Vulnerability
Summary
DVP80ES3 with
Improper Resource Shutdown or Release vulnerability.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-404 - Improper Resource Shutdown or Release
Assigner
References
1 reference
Impacted products
Date Public
2026-07-01 06:43
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12575",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T12:22:18.661817Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T12:22:28.713Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP80ES3",
"vendor": "deltaww",
"versions": [
{
"lessThanOrEqual": "1.06.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dvp80es3:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.06.00",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Qian Zou, Ke Xu, Xuewei Feng, Qi Li, Xueying Li, and Gang Jin from Zhongguancun Laboratory"
}
],
"datePublic": "2026-07-01T06:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DVP80ES3 with\u0026nbsp;\nImproper Resource Shutdown or Release vulnerability."
}
],
"value": "DVP80ES3 with\u00a0\nImproper Resource Shutdown or Release vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-119",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-119: Deplete Resources"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "CWE-404: Improper Resource Shutdown or Release",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T06:55:18.417Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00009_DVP80ES3%20Multiple%20Vulnerabilities_v1%20(CVE-2026-12575,%2012576,%2012577).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to update the device firmware to v01.08.10 or later."
}
],
"value": "Users are recommended to update the device firmware to v01.08.10 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP80ES3 Improper Resource Shutdown or Release Vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12575",
"datePublished": "2026-07-01T06:55:18.417Z",
"dateReserved": "2026-06-18T05:22:51.481Z",
"dateUpdated": "2026-07-01T12:22:28.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14193 (GCVE-0-2026-14193)
Vulnerability from nvd – Published: 2026-07-01 05:30 – Updated: 2026-07-01 12:28
VLAI
EPSS
VEX
Title
DVP80ES300T - Improper Validation of Array Index Vulnerability
Summary
DVP80ES300T with Improper Validation of Array Index Vulnerability
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| deltaww | DVP80ES300T |
Affected:
0 , ≤ 1.08
(custom)
|
Date Public
2026-07-01 05:16
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T12:27:51.499403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T12:28:00.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP80ES300T",
"vendor": "deltaww",
"versions": [
{
"lessThanOrEqual": "1.08",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CNVD"
}
],
"datePublic": "2026-07-01T05:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DVP80ES300T with Improper Validation of Array Index Vulnerability"
}
],
"value": "DVP80ES300T with Improper Validation of Array Index Vulnerability"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100: Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129 Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T05:30:54.717Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00013_DVP80ES300T%20Improper%20Validation%20of%20Array%20Index%20Vulnerability%20(CVE-2026-14193).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to upgrade the firmware to v1.10 or later."
}
],
"value": "Users are recommended to upgrade the firmware to v1.10 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP80ES300T - Improper Validation of Array Index Vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-14193",
"datePublished": "2026-07-01T05:30:54.717Z",
"dateReserved": "2026-06-30T08:45:55.964Z",
"dateUpdated": "2026-07-01T12:28:00.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12579 (GCVE-0-2026-12579)
Vulnerability from nvd – Published: 2026-07-01 05:22 – Updated: 2026-07-01 12:29
VLAI
EPSS
VEX
Title
AS228T - Authentication Bypass Vulnerability
Summary
AS228T with Authentication Bypass Vulnerability
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
Date Public
2026-07-01 05:16
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T12:29:11.035257Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T12:29:19.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AS228T",
"vendor": "deltaww",
"versions": [
{
"lessThanOrEqual": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CNVD"
}
],
"datePublic": "2026-07-01T05:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "AS228T with Authentication Bypass Vulnerability"
}
],
"value": "AS228T with Authentication Bypass Vulnerability"
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115: Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T05:22:38.951Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00012_AS228T%20Authentication%20Bypass%20Vulnerability%20(CVE-2026-12579).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to upgrade the firmware to v1.16 or later."
}
],
"value": "Users are recommended to upgrade the firmware to v1.16 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AS228T - Authentication Bypass Vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12579",
"datePublished": "2026-07-01T05:22:38.951Z",
"dateReserved": "2026-06-18T05:22:59.674Z",
"dateUpdated": "2026-07-01T12:29:19.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12578 (GCVE-0-2026-12578)
Vulnerability from nvd – Published: 2026-06-30 07:20 – Updated: 2026-06-30 12:50
VLAI
EPSS
VEX
Title
DTMSoft - Deserialization of Untrusted Data Vulnerability
Summary
The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-502 - Deserialization of untrusted data
Assigner
References
1 reference
Date Public
2026-06-25 01:36
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12578",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-30T12:49:59.088298Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:50:13.635Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DTMSoft",
"vendor": "deltaww",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dtmsoft:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CISA"
},
{
"lang": "en",
"type": "reporter",
"value": "kimiya working with Trend Micro Zero Day Initiative"
}
],
"datePublic": "2026-06-25T01:36:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code."
}
],
"value": "The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of untrusted data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T07:20:59.492Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00010_DTMSoft%20Project%20File%20Parsing%20Deserialization%20of%20Untrusted%20Data%20Remote%20Code%20(CVE-2026-12578)_v1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DTMSoft - Deserialization of Untrusted Data Vulnerability",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to take the following mitigation measures:\n\u003cbr\u003e\u003cul\u003e\u003cli\u003eDo not open unsolicited project files: Do not open or import unsolicited project files, untrusted Internet links, or unexpected attachments from emails, network shares, or USB drives. Always verify the source of the file before opening it.\n\u003c/li\u003e\u003cli\u003eAvoid running as administrator: Do not use the \"Run as Administrator\" option when launching the software. Running the software with standard user privileges effectively limits the damage of potential malicious code.\n\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
}
],
"value": "Users are recommended to take the following mitigation measures:\n\n * Do not open unsolicited project files: Do not open or import unsolicited project files, untrusted Internet links, or unexpected attachments from emails, network shares, or USB drives. Always verify the source of the file before opening it.\n\n * Avoid running as administrator: Do not use the \"Run as Administrator\" option when launching the software. Running the software with standard user privileges effectively limits the damage of potential malicious code."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12578",
"datePublished": "2026-06-30T07:20:59.492Z",
"dateReserved": "2026-06-18T05:22:58.068Z",
"dateUpdated": "2026-06-30T12:50:13.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12819 (GCVE-0-2026-12819)
Vulnerability from nvd – Published: 2026-06-30 06:28 – Updated: 2026-06-30 12:50
VLAI
EPSS
VEX
Title
DVP-12SE Missing Authentication and Unauthorized Write access Vulnerability
Summary
Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interaction with security-sensitive PLC functions.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Date Public
2026-06-30 05:29
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12819",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-30T12:50:51.923347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:50:59.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP-12SE",
"vendor": "deltaww",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dvp-12se:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CISA"
},
{
"lang": "en",
"type": "reporter",
"value": "Adm Bin Harbi (0xnoag) - Corvo Security"
}
],
"datePublic": "2026-06-30T05:29:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interaction with security-sensitive PLC functions."
}
],
"value": "Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interaction with security-sensitive PLC functions."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115: Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T06:28:51.514Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP-12SE Missing Authentication and Unauthorized Write access Vulnerability",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to take the following mitigation measures:\n\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnable the IP Filter feature: Configure and enable the PLC\u0027s built-in IP Filter function via the programming software. Restrict access exclusively to the IP addresses of trusted devices (such as designated HMI panels or SCADA hosts) to block unauthorized network access.\n\u003c/li\u003e\u003cli\u003eSet up PLC password protection: Enable password protection for the PLC within the programming software to ensure the device\u0027s core control logic and parameters cannot be easily downloaded, overwritten, or tampered with.\n\u003c/li\u003e\u003cli\u003eImplement network isolation and firewall protection: Deploy the PLC within an independent local area network (OT control network) secured by a firewall. Never connect the device directly to the office network or the Internet. If remote access is required, enforce the use of a secure, authorized VPN tunnel.\u0026nbsp;\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Users are recommended to take the following mitigation measures:\n\n * Enable the IP Filter feature: Configure and enable the PLC\u0027s built-in IP Filter function via the programming software. Restrict access exclusively to the IP addresses of trusted devices (such as designated HMI panels or SCADA hosts) to block unauthorized network access.\n\n * Set up PLC password protection: Enable password protection for the PLC within the programming software to ensure the device\u0027s core control logic and parameters cannot be easily downloaded, overwritten, or tampered with.\n\n * Implement network isolation and firewall protection: Deploy the PLC within an independent local area network (OT control network) secured by a firewall. Never connect the device directly to the office network or the Internet. If remote access is required, enforce the use of a secure, authorized VPN tunnel."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12819",
"datePublished": "2026-06-30T06:28:51.514Z",
"dateReserved": "2026-06-21T10:18:28.804Z",
"dateUpdated": "2026-06-30T12:50:59.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12818 (GCVE-0-2026-12818)
Vulnerability from nvd – Published: 2026-06-30 06:24 – Updated: 2026-06-30 12:55
VLAI
EPSS
VEX
Title
DVP-12SE Exposure of Sensitive Information Vulnerability
Summary
Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of resources without limits or throttling
Assigner
References
1 reference
Date Public
2026-06-30 05:29
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12818",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-30T12:54:54.979527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:55:02.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP-12SE",
"vendor": "deltaww",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dvp-12se:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CISA"
},
{
"lang": "en",
"type": "reporter",
"value": "Adm Bin Harbi (0xnoag) - Corvo Security"
}
],
"datePublic": "2026-06-30T05:29:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service."
}
],
"value": "Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125: Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T06:30:23.413Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP-12SE Exposure of Sensitive Information Vulnerability",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to take the following mitigation measures:\n\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnable the IP Filter feature: Configure and enable the PLC\u0027s built-in IP Filter function via the programming software. Restrict access exclusively to the IP addresses of trusted devices (such as designated HMI panels or SCADA hosts) to block unauthorized network access.\n\u003c/li\u003e\u003cli\u003eSet up PLC password protection: Enable password protection for the PLC within the programming software to ensure the device\u0027s core control logic and parameters cannot be easily downloaded, overwritten, or tampered with.\n\u003c/li\u003e\u003cli\u003eImplement network isolation and firewall protection: Deploy the PLC within an independent local area network (OT control network) secured by a firewall. Never connect the device directly to the office network or the Internet. If remote access is required, enforce the use of a secure, authorized VPN tunnel.\u0026nbsp;\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Users are recommended to take the following mitigation measures:\n\n * Enable the IP Filter feature: Configure and enable the PLC\u0027s built-in IP Filter function via the programming software. Restrict access exclusively to the IP addresses of trusted devices (such as designated HMI panels or SCADA hosts) to block unauthorized network access.\n\n * Set up PLC password protection: Enable password protection for the PLC within the programming software to ensure the device\u0027s core control logic and parameters cannot be easily downloaded, overwritten, or tampered with.\n\n * Implement network isolation and firewall protection: Deploy the PLC within an independent local area network (OT control network) secured by a firewall. Never connect the device directly to the office network or the Internet. If remote access is required, enforce the use of a secure, authorized VPN tunnel."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12818",
"datePublished": "2026-06-30T06:24:11.495Z",
"dateReserved": "2026-06-21T10:18:09.710Z",
"dateUpdated": "2026-06-30T12:55:02.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9642 (GCVE-0-2026-9642)
Vulnerability from nvd – Published: 2026-05-26 19:36 – Updated: 2026-06-03 14:52
VLAI
EPSS
VEX
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-06-03T14:52:28.257Z",
"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"shortName": "tenable"
},
"rejectedReasons": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
],
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"assignerShortName": "tenable",
"cveId": "CVE-2026-9642",
"datePublished": "2026-05-26T19:36:56.398Z",
"dateRejected": "2026-06-03T14:52:28.257Z",
"dateReserved": "2026-05-26T18:53:00.748Z",
"dateUpdated": "2026-06-03T14:52:28.257Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1952 (GCVE-0-2026-1952)
Vulnerability from nvd – Published: 2026-04-24 06:08 – Updated: 2026-04-24 15:26
VLAI
EPSS
VEX
Title
Denial of service via the undocumented subfunction in AS320T
Summary
Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
1 reference
Date Public
2026-04-24 05:26
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1952",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T15:25:54.104259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T15:26:08.538Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AS320T",
"vendor": "DeltaWW",
"versions": [
{
"lessThanOrEqual": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:as320t:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sergey Fedonin and Ivan Kurnakov (Positive Technologies)"
}
],
"datePublic": "2026-04-24T05:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics AS320T has denial of service via the undocumented subfunction\u0026nbsp;vulnerability."
}
],
"value": "Delta Electronics AS320T has denial of service via the undocumented subfunction\u00a0vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125: Flooding"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:08:58.826Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade firmware to v1.16 or later\u003cbr\u003e"
}
],
"value": "Upgrade firmware to v1.16 or later"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Denial of service via the undocumented subfunction in AS320T",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-1952",
"datePublished": "2026-04-24T06:08:58.826Z",
"dateReserved": "2026-02-05T05:43:02.712Z",
"dateUpdated": "2026-04-24T15:26:08.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1951 (GCVE-0-2026-1951)
Vulnerability from nvd – Published: 2026-04-24 06:13 – Updated: 2026-04-24 13:08
VLAI
EPSS
VEX
Title
No checking of the length of the buffer with the directory name in AS320T
Summary
Delta Electronics AS320T has no checking of the length of the buffer with the directory name
vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Date Public
2026-04-24 05:26
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1951",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T13:07:44.270512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T13:08:01.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AS320T",
"vendor": "DeltaWW",
"versions": [
{
"lessThanOrEqual": "1.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:as320t:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.10",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sergey Fedonin and Ivan Kurnakov (Positive Technologies)"
}
],
"datePublic": "2026-04-24T05:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics AS320T has no checking of the length of the buffer with the directory name\n\n vulnerability."
}
],
"value": "Delta Electronics AS320T has no checking of the length of the buffer with the directory name\n\n vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100: Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:13:35.539Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade firmware to v1.12 or later\u003cbr\u003e"
}
],
"value": "Upgrade firmware to v1.12 or later"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "No checking of the length of the buffer with the directory name in AS320T",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-1951",
"datePublished": "2026-04-24T06:13:35.539Z",
"dateReserved": "2026-02-05T05:43:01.572Z",
"dateUpdated": "2026-04-24T13:08:01.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1950 (GCVE-0-2026-1950)
Vulnerability from nvd – Published: 2026-04-24 05:56 – Updated: 2026-04-24 15:27
VLAI
EPSS
VEX
Title
No checking of the length of the buffer with the file name in AS320T
Summary
Delta Electronics AS320T has
No checking of the length of the buffer with the file name vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Date Public
2026-04-24 05:26
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1950",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T15:27:30.485037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T15:27:45.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AS320T",
"vendor": "DeltaWW",
"versions": [
{
"lessThanOrEqual": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:as320t:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sergey Fedonin and Ivan Kurnakov (Positive Technologies)"
}
],
"datePublic": "2026-04-24T05:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics AS320T has \nNo checking of the length of the buffer with the file name vulnerability."
}
],
"value": "Delta Electronics AS320T has \nNo checking of the length of the buffer with the file name vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100: Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:06.239Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade firmware to v1.16 or later\u003cbr\u003e"
}
],
"value": "Upgrade firmware to v1.16 or later"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "No checking of the length of the buffer with the file name in AS320T",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-1950",
"datePublished": "2026-04-24T05:56:52.385Z",
"dateReserved": "2026-02-05T05:43:00.436Z",
"dateUpdated": "2026-04-24T15:27:45.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1949 (GCVE-0-2026-1949)
Vulnerability from nvd – Published: 2026-04-24 05:50 – Updated: 2026-04-24 15:27
VLAI
EPSS
VEX
Title
Incorrect calculation of buffer size on the stack in AS320T
Summary
Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-131 - Incorrect Calculation of Buffer Size
Assigner
References
1 reference
Date Public
2026-04-24 05:26
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1949",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T15:26:55.912129Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T15:27:12.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AS320T",
"vendor": "DeltaWW",
"versions": [
{
"lessThanOrEqual": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:as320t:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sergey Fedonin and Ivan Kurnakov (Positive Technologies)"
}
],
"datePublic": "2026-04-24T05:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service."
}
],
"value": "Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100: Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "CWE-131 Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T05:50:48.468Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade firmware to v1.16 or later\u003cbr\u003e"
}
],
"value": "Upgrade firmware to v1.16 or later"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Incorrect calculation of buffer size on the stack in AS320T",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-1949",
"datePublished": "2026-04-24T05:50:48.468Z",
"dateReserved": "2026-02-05T05:42:58.810Z",
"dateUpdated": "2026-04-24T15:27:12.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5726 (GCVE-0-2026-5726)
Vulnerability from nvd – Published: 2026-04-08 01:46 – Updated: 2026-04-08 15:58
VLAI
EPSS
VEX
Title
ASDA-Soft Stack-based Buffer Overflow Vulnerability
Summary
ASDA-Soft Stack-based Buffer Overflow Vulnerability
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
Date Public
2026-04-08 01:25
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5726",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T15:57:58.781751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T15:58:11.280Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "ASDA-Soft",
"vendor": "DeltaWW",
"versions": [
{
"lessThanOrEqual": "7.2.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:asda-soft:*:*:windows:*:*:*:*:*",
"versionEndIncluding": "7.2.2.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CISA"
},
{
"lang": "en",
"type": "reporter",
"value": "Zero Day Initiative (ZDI)"
}
],
"datePublic": "2026-04-08T01:25:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ASDA-Soft Stack-based Buffer Overflow Vulnerability"
}
],
"value": "ASDA-Soft Stack-based Buffer Overflow Vulnerability"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T01:46:51.352Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00007_ASDA-Soft%20Stack-based%20Buffer%20Overflow%20Vulnerability%20(CVE-2026-5726).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Download and update to: ASDA-Soft v7.2.6.0 or later (Delta Download Center)\u003cbr\u003e"
}
],
"value": "Download and update to: ASDA-Soft v7.2.6.0 or later (Delta Download Center)"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ASDA-Soft Stack-based Buffer Overflow Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-5726",
"datePublished": "2026-04-08T01:46:51.352Z",
"dateReserved": "2026-04-07T08:41:00.448Z",
"dateUpdated": "2026-04-08T15:58:11.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12577 (GCVE-0-2026-12577)
Vulnerability from cvelistv5 – Published: 2026-07-01 07:05 – Updated: 2026-07-01 12:35
VLAI
EPSS
VEX
Title
DVP80ES3 Improperly Implemented Security Check for Standard vulnerability
Summary
DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-358 - Improperly Implemented Security Check for Standard
Assigner
References
1 reference
Impacted products
Date Public
2026-07-01 06:43
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12577",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T12:34:42.567445Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T12:35:02.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP80ES3",
"vendor": "deltaww",
"versions": [
{
"lessThanOrEqual": "1.08.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dvp80es3:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.08.10",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Qian Zou, Ke Xu, Xuewei Feng, Qi Li, Xueying Li, and Gang Jin from Zhongguancun Laboratory"
}
],
"datePublic": "2026-07-01T06:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability."
}
],
"value": "DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-596",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-596: TCP RST Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-358",
"description": "CWE-358: Improperly Implemented Security Check for Standard",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T07:05:25.146Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00009_DVP80ES3%20Multiple%20Vulnerabilities_v1%20(CVE-2026-12575,%2012576,%2012577).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to update the device firmware to v01.10.00 or later."
}
],
"value": "Users are recommended to update the device firmware to v01.10.00 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP80ES3 Improperly Implemented Security Check for Standard vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12577",
"datePublished": "2026-07-01T07:05:25.146Z",
"dateReserved": "2026-06-18T05:22:55.191Z",
"dateUpdated": "2026-07-01T12:35:02.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12576 (GCVE-0-2026-12576)
Vulnerability from cvelistv5 – Published: 2026-07-01 07:01 – Updated: 2026-07-01 12:21
VLAI
EPSS
VEX
Title
DVP80ES3 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability
Summary
DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-924 - Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Assigner
References
1 reference
Impacted products
Date Public
2026-07-01 06:43
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12576",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T12:21:21.101697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T12:21:28.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP80ES3",
"vendor": "deltaww",
"versions": [
{
"lessThanOrEqual": "1.06.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dvp80es3:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.06.00",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Qian Zou, Ke Xu, Xuewei Feng, Qi Li, Xueying Li, and Gang Jin from Zhongguancun Laboratory"
}
],
"datePublic": "2026-07-01T06:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability."
}
],
"value": "DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-596",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-596: TCP RST Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-924",
"description": "CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T07:01:17.903Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00009_DVP80ES3%20Multiple%20Vulnerabilities_v1%20(CVE-2026-12575,%2012576,%2012577).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to update the device firmware to v01.08.10 or later."
}
],
"value": "Users are recommended to update the device firmware to v01.08.10 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP80ES3 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12576",
"datePublished": "2026-07-01T07:01:17.903Z",
"dateReserved": "2026-06-18T05:22:53.986Z",
"dateUpdated": "2026-07-01T12:21:28.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12575 (GCVE-0-2026-12575)
Vulnerability from cvelistv5 – Published: 2026-07-01 06:55 – Updated: 2026-07-01 12:22
VLAI
EPSS
VEX
Title
DVP80ES3 Improper Resource Shutdown or Release Vulnerability
Summary
DVP80ES3 with
Improper Resource Shutdown or Release vulnerability.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-404 - Improper Resource Shutdown or Release
Assigner
References
1 reference
Impacted products
Date Public
2026-07-01 06:43
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12575",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T12:22:18.661817Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T12:22:28.713Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP80ES3",
"vendor": "deltaww",
"versions": [
{
"lessThanOrEqual": "1.06.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dvp80es3:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.06.00",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Qian Zou, Ke Xu, Xuewei Feng, Qi Li, Xueying Li, and Gang Jin from Zhongguancun Laboratory"
}
],
"datePublic": "2026-07-01T06:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DVP80ES3 with\u0026nbsp;\nImproper Resource Shutdown or Release vulnerability."
}
],
"value": "DVP80ES3 with\u00a0\nImproper Resource Shutdown or Release vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-119",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-119: Deplete Resources"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "CWE-404: Improper Resource Shutdown or Release",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T06:55:18.417Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00009_DVP80ES3%20Multiple%20Vulnerabilities_v1%20(CVE-2026-12575,%2012576,%2012577).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to update the device firmware to v01.08.10 or later."
}
],
"value": "Users are recommended to update the device firmware to v01.08.10 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP80ES3 Improper Resource Shutdown or Release Vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12575",
"datePublished": "2026-07-01T06:55:18.417Z",
"dateReserved": "2026-06-18T05:22:51.481Z",
"dateUpdated": "2026-07-01T12:22:28.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14193 (GCVE-0-2026-14193)
Vulnerability from cvelistv5 – Published: 2026-07-01 05:30 – Updated: 2026-07-01 12:28
VLAI
EPSS
VEX
Title
DVP80ES300T - Improper Validation of Array Index Vulnerability
Summary
DVP80ES300T with Improper Validation of Array Index Vulnerability
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| deltaww | DVP80ES300T |
Affected:
0 , ≤ 1.08
(custom)
|
Date Public
2026-07-01 05:16
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T12:27:51.499403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T12:28:00.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP80ES300T",
"vendor": "deltaww",
"versions": [
{
"lessThanOrEqual": "1.08",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CNVD"
}
],
"datePublic": "2026-07-01T05:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DVP80ES300T with Improper Validation of Array Index Vulnerability"
}
],
"value": "DVP80ES300T with Improper Validation of Array Index Vulnerability"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100: Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129 Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T05:30:54.717Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00013_DVP80ES300T%20Improper%20Validation%20of%20Array%20Index%20Vulnerability%20(CVE-2026-14193).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to upgrade the firmware to v1.10 or later."
}
],
"value": "Users are recommended to upgrade the firmware to v1.10 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP80ES300T - Improper Validation of Array Index Vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-14193",
"datePublished": "2026-07-01T05:30:54.717Z",
"dateReserved": "2026-06-30T08:45:55.964Z",
"dateUpdated": "2026-07-01T12:28:00.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12579 (GCVE-0-2026-12579)
Vulnerability from cvelistv5 – Published: 2026-07-01 05:22 – Updated: 2026-07-01 12:29
VLAI
EPSS
VEX
Title
AS228T - Authentication Bypass Vulnerability
Summary
AS228T with Authentication Bypass Vulnerability
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
Date Public
2026-07-01 05:16
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-01T12:29:11.035257Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T12:29:19.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AS228T",
"vendor": "deltaww",
"versions": [
{
"lessThanOrEqual": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CNVD"
}
],
"datePublic": "2026-07-01T05:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "AS228T with Authentication Bypass Vulnerability"
}
],
"value": "AS228T with Authentication Bypass Vulnerability"
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115: Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T05:22:38.951Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00012_AS228T%20Authentication%20Bypass%20Vulnerability%20(CVE-2026-12579).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to upgrade the firmware to v1.16 or later."
}
],
"value": "Users are recommended to upgrade the firmware to v1.16 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AS228T - Authentication Bypass Vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12579",
"datePublished": "2026-07-01T05:22:38.951Z",
"dateReserved": "2026-06-18T05:22:59.674Z",
"dateUpdated": "2026-07-01T12:29:19.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12578 (GCVE-0-2026-12578)
Vulnerability from cvelistv5 – Published: 2026-06-30 07:20 – Updated: 2026-06-30 12:50
VLAI
EPSS
VEX
Title
DTMSoft - Deserialization of Untrusted Data Vulnerability
Summary
The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-502 - Deserialization of untrusted data
Assigner
References
1 reference
Date Public
2026-06-25 01:36
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12578",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-30T12:49:59.088298Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:50:13.635Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DTMSoft",
"vendor": "deltaww",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dtmsoft:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CISA"
},
{
"lang": "en",
"type": "reporter",
"value": "kimiya working with Trend Micro Zero Day Initiative"
}
],
"datePublic": "2026-06-25T01:36:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code."
}
],
"value": "The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code."
}
],
"impacts": [
{
"capecId": "CAPEC-586",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-586 Object Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of untrusted data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T07:20:59.492Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00010_DTMSoft%20Project%20File%20Parsing%20Deserialization%20of%20Untrusted%20Data%20Remote%20Code%20(CVE-2026-12578)_v1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DTMSoft - Deserialization of Untrusted Data Vulnerability",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to take the following mitigation measures:\n\u003cbr\u003e\u003cul\u003e\u003cli\u003eDo not open unsolicited project files: Do not open or import unsolicited project files, untrusted Internet links, or unexpected attachments from emails, network shares, or USB drives. Always verify the source of the file before opening it.\n\u003c/li\u003e\u003cli\u003eAvoid running as administrator: Do not use the \"Run as Administrator\" option when launching the software. Running the software with standard user privileges effectively limits the damage of potential malicious code.\n\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
}
],
"value": "Users are recommended to take the following mitigation measures:\n\n * Do not open unsolicited project files: Do not open or import unsolicited project files, untrusted Internet links, or unexpected attachments from emails, network shares, or USB drives. Always verify the source of the file before opening it.\n\n * Avoid running as administrator: Do not use the \"Run as Administrator\" option when launching the software. Running the software with standard user privileges effectively limits the damage of potential malicious code."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12578",
"datePublished": "2026-06-30T07:20:59.492Z",
"dateReserved": "2026-06-18T05:22:58.068Z",
"dateUpdated": "2026-06-30T12:50:13.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12819 (GCVE-0-2026-12819)
Vulnerability from cvelistv5 – Published: 2026-06-30 06:28 – Updated: 2026-06-30 12:50
VLAI
EPSS
VEX
Title
DVP-12SE Missing Authentication and Unauthorized Write access Vulnerability
Summary
Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interaction with security-sensitive PLC functions.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Date Public
2026-06-30 05:29
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12819",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-30T12:50:51.923347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:50:59.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP-12SE",
"vendor": "deltaww",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dvp-12se:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CISA"
},
{
"lang": "en",
"type": "reporter",
"value": "Adm Bin Harbi (0xnoag) - Corvo Security"
}
],
"datePublic": "2026-06-30T05:29:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interaction with security-sensitive PLC functions."
}
],
"value": "Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interaction with security-sensitive PLC functions."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115: Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T06:28:51.514Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP-12SE Missing Authentication and Unauthorized Write access Vulnerability",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to take the following mitigation measures:\n\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnable the IP Filter feature: Configure and enable the PLC\u0027s built-in IP Filter function via the programming software. Restrict access exclusively to the IP addresses of trusted devices (such as designated HMI panels or SCADA hosts) to block unauthorized network access.\n\u003c/li\u003e\u003cli\u003eSet up PLC password protection: Enable password protection for the PLC within the programming software to ensure the device\u0027s core control logic and parameters cannot be easily downloaded, overwritten, or tampered with.\n\u003c/li\u003e\u003cli\u003eImplement network isolation and firewall protection: Deploy the PLC within an independent local area network (OT control network) secured by a firewall. Never connect the device directly to the office network or the Internet. If remote access is required, enforce the use of a secure, authorized VPN tunnel.\u0026nbsp;\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Users are recommended to take the following mitigation measures:\n\n * Enable the IP Filter feature: Configure and enable the PLC\u0027s built-in IP Filter function via the programming software. Restrict access exclusively to the IP addresses of trusted devices (such as designated HMI panels or SCADA hosts) to block unauthorized network access.\n\n * Set up PLC password protection: Enable password protection for the PLC within the programming software to ensure the device\u0027s core control logic and parameters cannot be easily downloaded, overwritten, or tampered with.\n\n * Implement network isolation and firewall protection: Deploy the PLC within an independent local area network (OT control network) secured by a firewall. Never connect the device directly to the office network or the Internet. If remote access is required, enforce the use of a secure, authorized VPN tunnel."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12819",
"datePublished": "2026-06-30T06:28:51.514Z",
"dateReserved": "2026-06-21T10:18:28.804Z",
"dateUpdated": "2026-06-30T12:50:59.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12818 (GCVE-0-2026-12818)
Vulnerability from cvelistv5 – Published: 2026-06-30 06:24 – Updated: 2026-06-30 12:55
VLAI
EPSS
VEX
Title
DVP-12SE Exposure of Sensitive Information Vulnerability
Summary
Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of resources without limits or throttling
Assigner
References
1 reference
Date Public
2026-06-30 05:29
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12818",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-30T12:54:54.979527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:55:02.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DVP-12SE",
"vendor": "deltaww",
"versions": [
{
"status": "affected",
"version": "*"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:dvp-12se:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "CISA"
},
{
"lang": "en",
"type": "reporter",
"value": "Adm Bin Harbi (0xnoag) - Corvo Security"
}
],
"datePublic": "2026-06-30T05:29:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service."
}
],
"value": "Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125: Flooding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T06:30:23.413Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "DVP-12SE Exposure of Sensitive Information Vulnerability",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are recommended to take the following mitigation measures:\n\u003cbr\u003e\u003cul\u003e\u003cli\u003eEnable the IP Filter feature: Configure and enable the PLC\u0027s built-in IP Filter function via the programming software. Restrict access exclusively to the IP addresses of trusted devices (such as designated HMI panels or SCADA hosts) to block unauthorized network access.\n\u003c/li\u003e\u003cli\u003eSet up PLC password protection: Enable password protection for the PLC within the programming software to ensure the device\u0027s core control logic and parameters cannot be easily downloaded, overwritten, or tampered with.\n\u003c/li\u003e\u003cli\u003eImplement network isolation and firewall protection: Deploy the PLC within an independent local area network (OT control network) secured by a firewall. Never connect the device directly to the office network or the Internet. If remote access is required, enforce the use of a secure, authorized VPN tunnel.\u0026nbsp;\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Users are recommended to take the following mitigation measures:\n\n * Enable the IP Filter feature: Configure and enable the PLC\u0027s built-in IP Filter function via the programming software. Restrict access exclusively to the IP addresses of trusted devices (such as designated HMI panels or SCADA hosts) to block unauthorized network access.\n\n * Set up PLC password protection: Enable password protection for the PLC within the programming software to ensure the device\u0027s core control logic and parameters cannot be easily downloaded, overwritten, or tampered with.\n\n * Implement network isolation and firewall protection: Deploy the PLC within an independent local area network (OT control network) secured by a firewall. Never connect the device directly to the office network or the Internet. If remote access is required, enforce the use of a secure, authorized VPN tunnel."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-12818",
"datePublished": "2026-06-30T06:24:11.495Z",
"dateReserved": "2026-06-21T10:18:09.710Z",
"dateUpdated": "2026-06-30T12:55:02.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9642 (GCVE-0-2026-9642)
Vulnerability from cvelistv5 – Published: 2026-05-26 19:36 – Updated: 2026-06-03 14:52
VLAI
EPSS
VEX
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-06-03T14:52:28.257Z",
"orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"shortName": "tenable"
},
"rejectedReasons": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
],
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
"assignerShortName": "tenable",
"cveId": "CVE-2026-9642",
"datePublished": "2026-05-26T19:36:56.398Z",
"dateRejected": "2026-06-03T14:52:28.257Z",
"dateReserved": "2026-05-26T18:53:00.748Z",
"dateUpdated": "2026-06-03T14:52:28.257Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1951 (GCVE-0-2026-1951)
Vulnerability from cvelistv5 – Published: 2026-04-24 06:13 – Updated: 2026-04-24 13:08
VLAI
EPSS
VEX
Title
No checking of the length of the buffer with the directory name in AS320T
Summary
Delta Electronics AS320T has no checking of the length of the buffer with the directory name
vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Date Public
2026-04-24 05:26
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1951",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T13:07:44.270512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T13:08:01.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AS320T",
"vendor": "DeltaWW",
"versions": [
{
"lessThanOrEqual": "1.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:as320t:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.10",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sergey Fedonin and Ivan Kurnakov (Positive Technologies)"
}
],
"datePublic": "2026-04-24T05:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics AS320T has no checking of the length of the buffer with the directory name\n\n vulnerability."
}
],
"value": "Delta Electronics AS320T has no checking of the length of the buffer with the directory name\n\n vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100: Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:13:35.539Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade firmware to v1.12 or later\u003cbr\u003e"
}
],
"value": "Upgrade firmware to v1.12 or later"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "No checking of the length of the buffer with the directory name in AS320T",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-1951",
"datePublished": "2026-04-24T06:13:35.539Z",
"dateReserved": "2026-02-05T05:43:01.572Z",
"dateUpdated": "2026-04-24T13:08:01.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1952 (GCVE-0-2026-1952)
Vulnerability from cvelistv5 – Published: 2026-04-24 06:08 – Updated: 2026-04-24 15:26
VLAI
EPSS
VEX
Title
Denial of service via the undocumented subfunction in AS320T
Summary
Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
1 reference
Date Public
2026-04-24 05:26
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1952",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T15:25:54.104259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T15:26:08.538Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AS320T",
"vendor": "DeltaWW",
"versions": [
{
"lessThanOrEqual": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:as320t:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sergey Fedonin and Ivan Kurnakov (Positive Technologies)"
}
],
"datePublic": "2026-04-24T05:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics AS320T has denial of service via the undocumented subfunction\u0026nbsp;vulnerability."
}
],
"value": "Delta Electronics AS320T has denial of service via the undocumented subfunction\u00a0vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-125",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-125: Flooding"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:08:58.826Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade firmware to v1.16 or later\u003cbr\u003e"
}
],
"value": "Upgrade firmware to v1.16 or later"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Denial of service via the undocumented subfunction in AS320T",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-1952",
"datePublished": "2026-04-24T06:08:58.826Z",
"dateReserved": "2026-02-05T05:43:02.712Z",
"dateUpdated": "2026-04-24T15:26:08.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1950 (GCVE-0-2026-1950)
Vulnerability from cvelistv5 – Published: 2026-04-24 05:56 – Updated: 2026-04-24 15:27
VLAI
EPSS
VEX
Title
No checking of the length of the buffer with the file name in AS320T
Summary
Delta Electronics AS320T has
No checking of the length of the buffer with the file name vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Date Public
2026-04-24 05:26
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1950",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T15:27:30.485037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T15:27:45.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AS320T",
"vendor": "DeltaWW",
"versions": [
{
"lessThanOrEqual": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:as320t:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sergey Fedonin and Ivan Kurnakov (Positive Technologies)"
}
],
"datePublic": "2026-04-24T05:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics AS320T has \nNo checking of the length of the buffer with the file name vulnerability."
}
],
"value": "Delta Electronics AS320T has \nNo checking of the length of the buffer with the file name vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100: Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T06:00:06.239Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade firmware to v1.16 or later\u003cbr\u003e"
}
],
"value": "Upgrade firmware to v1.16 or later"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "No checking of the length of the buffer with the file name in AS320T",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-1950",
"datePublished": "2026-04-24T05:56:52.385Z",
"dateReserved": "2026-02-05T05:43:00.436Z",
"dateUpdated": "2026-04-24T15:27:45.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1949 (GCVE-0-2026-1949)
Vulnerability from cvelistv5 – Published: 2026-04-24 05:50 – Updated: 2026-04-24 15:27
VLAI
EPSS
VEX
Title
Incorrect calculation of buffer size on the stack in AS320T
Summary
Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-131 - Incorrect Calculation of Buffer Size
Assigner
References
1 reference
Date Public
2026-04-24 05:26
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1949",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-24T15:26:55.912129Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T15:27:12.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AS320T",
"vendor": "DeltaWW",
"versions": [
{
"lessThanOrEqual": "1.14",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:deltaww:as320t:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.14",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sergey Fedonin and Ivan Kurnakov (Positive Technologies)"
}
],
"datePublic": "2026-04-24T05:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service."
}
],
"value": "Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100: Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "CWE-131 Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-24T05:50:48.468Z",
"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"shortName": "Deltaww"
},
"references": [
{
"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00006_AS320T%20Multiple%20vulnerabilities%20(CVE-2026-1949,%201950,%201951,%201952).pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade firmware to v1.16 or later\u003cbr\u003e"
}
],
"value": "Upgrade firmware to v1.16 or later"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Incorrect calculation of buffer size on the stack in AS320T",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b",
"assignerShortName": "Deltaww",
"cveId": "CVE-2026-1949",
"datePublished": "2026-04-24T05:50:48.468Z",
"dateReserved": "2026-02-05T05:42:58.810Z",
"dateUpdated": "2026-04-24T15:27:12.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
VAR-201803-1810
Vulnerability from variot - Updated: 2026-04-11 00:02A Stack-based Buffer Overflow issue was discovered in Delta Electronics Delta Industrial Automation DOPSoft, Version 4.00.01 or prior. Stack-based buffer overflow vulnerabilities caused by processing specially crafted .dop or .dpb files may allow an attacker to remotely execute arbitrary code. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation DOPSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of the ButtonOnMacro structure in a DPA file. An attacker can leverage this vulnerability to execute code under the context of the current process. Failed exploit attempts will likely cause a denial-of-service condition. Versions prior to DOPSoft 4.00.04 are vulnerable
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "dopsoft",
"scope": null,
"trust": 9.8,
"vendor": "delta industrial automation",
"version": null
},
{
"_id": null,
"model": "delta industrial automation dopsoft",
"scope": "lte",
"trust": 1.0,
"vendor": "deltaww",
"version": "4.00.01"
},
{
"_id": null,
"model": "electronics delta industrial automation dopsoft",
"scope": "lte",
"trust": 0.6,
"vendor": "delta",
"version": "\u003c=4.00.01"
},
{
"_id": null,
"model": "delta industrial automation dopsoft",
"scope": "eq",
"trust": 0.6,
"vendor": "deltaww",
"version": "4.00.01"
},
{
"_id": null,
"model": "electronics inc dopsoft",
"scope": "eq",
"trust": 0.3,
"vendor": "delta",
"version": "4.0.1"
},
{
"_id": null,
"model": "electronics inc dopsoft",
"scope": "eq",
"trust": 0.3,
"vendor": "delta",
"version": "2.0.5"
},
{
"_id": null,
"model": "electronics inc dopsoft",
"scope": "eq",
"trust": 0.3,
"vendor": "delta",
"version": "2.00.04.09"
},
{
"_id": null,
"model": "electronics inc dopsoft",
"scope": "ne",
"trust": 0.3,
"vendor": "delta",
"version": "4.0.4"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "delta industrial automation dopsoft",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-18-234"
},
{
"db": "ZDI",
"id": "ZDI-18-229"
},
{
"db": "ZDI",
"id": "ZDI-18-228"
},
{
"db": "ZDI",
"id": "ZDI-18-222"
},
{
"db": "ZDI",
"id": "ZDI-18-233"
},
{
"db": "ZDI",
"id": "ZDI-18-227"
},
{
"db": "ZDI",
"id": "ZDI-18-235"
},
{
"db": "ZDI",
"id": "ZDI-18-220"
},
{
"db": "ZDI",
"id": "ZDI-18-231"
},
{
"db": "ZDI",
"id": "ZDI-18-226"
},
{
"db": "ZDI",
"id": "ZDI-18-230"
},
{
"db": "ZDI",
"id": "ZDI-18-232"
},
{
"db": "ZDI",
"id": "ZDI-18-221"
},
{
"db": "ZDI",
"id": "ZDI-18-224"
},
{
"db": "CNVD",
"id": "CNVD-2018-04098"
},
{
"db": "BID",
"id": "103195"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-561"
},
{
"db": "NVD",
"id": "CVE-2018-5476"
}
]
},
"credits": {
"_id": null,
"data": "Ghirmay Desta",
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-234"
},
{
"db": "ZDI",
"id": "ZDI-18-229"
},
{
"db": "ZDI",
"id": "ZDI-18-228"
},
{
"db": "ZDI",
"id": "ZDI-18-222"
},
{
"db": "ZDI",
"id": "ZDI-18-233"
},
{
"db": "ZDI",
"id": "ZDI-18-227"
},
{
"db": "ZDI",
"id": "ZDI-18-235"
},
{
"db": "ZDI",
"id": "ZDI-18-220"
},
{
"db": "ZDI",
"id": "ZDI-18-231"
},
{
"db": "ZDI",
"id": "ZDI-18-226"
},
{
"db": "ZDI",
"id": "ZDI-18-230"
},
{
"db": "ZDI",
"id": "ZDI-18-232"
},
{
"db": "ZDI",
"id": "ZDI-18-221"
},
{
"db": "ZDI",
"id": "ZDI-18-224"
}
],
"trust": 9.8
},
"cve": "CVE-2018-5476",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2018-5476",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 10.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CNVD-2018-04098",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2018-5476",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2018-5476",
"trust": 9.8,
"value": "MEDIUM"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2018-5476",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2018-04098",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201803-561",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-18-234"
},
{
"db": "ZDI",
"id": "ZDI-18-229"
},
{
"db": "ZDI",
"id": "ZDI-18-228"
},
{
"db": "ZDI",
"id": "ZDI-18-222"
},
{
"db": "ZDI",
"id": "ZDI-18-233"
},
{
"db": "ZDI",
"id": "ZDI-18-227"
},
{
"db": "ZDI",
"id": "ZDI-18-235"
},
{
"db": "ZDI",
"id": "ZDI-18-220"
},
{
"db": "ZDI",
"id": "ZDI-18-231"
},
{
"db": "ZDI",
"id": "ZDI-18-226"
},
{
"db": "ZDI",
"id": "ZDI-18-230"
},
{
"db": "ZDI",
"id": "ZDI-18-232"
},
{
"db": "ZDI",
"id": "ZDI-18-221"
},
{
"db": "ZDI",
"id": "ZDI-18-224"
},
{
"db": "CNVD",
"id": "CNVD-2018-04098"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-561"
},
{
"db": "NVD",
"id": "CVE-2018-5476"
}
]
},
"description": {
"_id": null,
"data": "A Stack-based Buffer Overflow issue was discovered in Delta Electronics Delta Industrial Automation DOPSoft, Version 4.00.01 or prior. Stack-based buffer overflow vulnerabilities caused by processing specially crafted .dop or .dpb files may allow an attacker to remotely execute arbitrary code. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation DOPSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of the ButtonOnMacro structure in a DPA file. An attacker can leverage this vulnerability to execute code under the context of the current process. Failed exploit attempts will likely cause a denial-of-service condition. \nVersions prior to DOPSoft 4.00.04 are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-5476"
},
{
"db": "ZDI",
"id": "ZDI-18-220"
},
{
"db": "ZDI",
"id": "ZDI-18-224"
},
{
"db": "ZDI",
"id": "ZDI-18-221"
},
{
"db": "ZDI",
"id": "ZDI-18-232"
},
{
"db": "ZDI",
"id": "ZDI-18-230"
},
{
"db": "ZDI",
"id": "ZDI-18-226"
},
{
"db": "ZDI",
"id": "ZDI-18-234"
},
{
"db": "ZDI",
"id": "ZDI-18-231"
},
{
"db": "ZDI",
"id": "ZDI-18-235"
},
{
"db": "ZDI",
"id": "ZDI-18-227"
},
{
"db": "ZDI",
"id": "ZDI-18-233"
},
{
"db": "ZDI",
"id": "ZDI-18-222"
},
{
"db": "ZDI",
"id": "ZDI-18-228"
},
{
"db": "ZDI",
"id": "ZDI-18-229"
},
{
"db": "CNVD",
"id": "CNVD-2018-04098"
},
{
"db": "BID",
"id": "103195"
},
{
"db": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1"
}
],
"trust": 10.71
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2018-5476",
"trust": 12.5
},
{
"db": "ICS CERT",
"id": "ICSA-18-060-03",
"trust": 2.5
},
{
"db": "BID",
"id": "103195",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2018-04098",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201803-561",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5286",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-234",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5275",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-229",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5274",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-228",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5267",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-222",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5285",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-233",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5272",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-227",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5287",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-235",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5265",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-220",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5283",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-231",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5271",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-226",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5276",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-230",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5284",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-232",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5266",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-221",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5269",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-224",
"trust": 0.7
},
{
"db": "IVD",
"id": "E2FF6511-39AB-11E9-8816-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-18-234"
},
{
"db": "ZDI",
"id": "ZDI-18-229"
},
{
"db": "ZDI",
"id": "ZDI-18-228"
},
{
"db": "ZDI",
"id": "ZDI-18-222"
},
{
"db": "ZDI",
"id": "ZDI-18-233"
},
{
"db": "ZDI",
"id": "ZDI-18-227"
},
{
"db": "ZDI",
"id": "ZDI-18-235"
},
{
"db": "ZDI",
"id": "ZDI-18-220"
},
{
"db": "ZDI",
"id": "ZDI-18-231"
},
{
"db": "ZDI",
"id": "ZDI-18-226"
},
{
"db": "ZDI",
"id": "ZDI-18-230"
},
{
"db": "ZDI",
"id": "ZDI-18-232"
},
{
"db": "ZDI",
"id": "ZDI-18-221"
},
{
"db": "ZDI",
"id": "ZDI-18-224"
},
{
"db": "CNVD",
"id": "CNVD-2018-04098"
},
{
"db": "BID",
"id": "103195"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-561"
},
{
"db": "NVD",
"id": "CVE-2018-5476"
}
]
},
"id": "VAR-201803-1810",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-04098"
}
],
"trust": 1.7285714
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-04098"
}
]
},
"last_update_date": "2026-04-11T00:02:19.122000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Delta Industrial Automation has issued an update to correct this vulnerability.",
"trust": 9.8,
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-060-03"
},
{
"title": "Delta Electronics Delta Industrial Automation patch for DOPSoft heap buffer overflow vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/120063"
},
{
"title": "Delta Electronics Delta Industrial Automation DOPSoft Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79197"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-234"
},
{
"db": "ZDI",
"id": "ZDI-18-229"
},
{
"db": "ZDI",
"id": "ZDI-18-228"
},
{
"db": "ZDI",
"id": "ZDI-18-222"
},
{
"db": "ZDI",
"id": "ZDI-18-233"
},
{
"db": "ZDI",
"id": "ZDI-18-227"
},
{
"db": "ZDI",
"id": "ZDI-18-235"
},
{
"db": "ZDI",
"id": "ZDI-18-220"
},
{
"db": "ZDI",
"id": "ZDI-18-231"
},
{
"db": "ZDI",
"id": "ZDI-18-226"
},
{
"db": "ZDI",
"id": "ZDI-18-230"
},
{
"db": "ZDI",
"id": "ZDI-18-232"
},
{
"db": "ZDI",
"id": "ZDI-18-221"
},
{
"db": "ZDI",
"id": "ZDI-18-224"
},
{
"db": "CNVD",
"id": "CNVD-2018-04098"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-561"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-121",
"trust": 1.0
},
{
"problemtype": "CWE-787",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-5476"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 12.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-060-03"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/103195"
},
{
"trust": 0.3,
"url": "http://www.deltaww.com/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-234"
},
{
"db": "ZDI",
"id": "ZDI-18-229"
},
{
"db": "ZDI",
"id": "ZDI-18-228"
},
{
"db": "ZDI",
"id": "ZDI-18-222"
},
{
"db": "ZDI",
"id": "ZDI-18-233"
},
{
"db": "ZDI",
"id": "ZDI-18-227"
},
{
"db": "ZDI",
"id": "ZDI-18-235"
},
{
"db": "ZDI",
"id": "ZDI-18-220"
},
{
"db": "ZDI",
"id": "ZDI-18-231"
},
{
"db": "ZDI",
"id": "ZDI-18-226"
},
{
"db": "ZDI",
"id": "ZDI-18-230"
},
{
"db": "ZDI",
"id": "ZDI-18-232"
},
{
"db": "ZDI",
"id": "ZDI-18-221"
},
{
"db": "ZDI",
"id": "ZDI-18-224"
},
{
"db": "CNVD",
"id": "CNVD-2018-04098"
},
{
"db": "BID",
"id": "103195"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-561"
},
{
"db": "NVD",
"id": "CVE-2018-5476"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-234",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-229",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-228",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-222",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-233",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-227",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-235",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-220",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-231",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-226",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-230",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-232",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-221",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-18-224",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2018-04098",
"ident": null
},
{
"db": "BID",
"id": "103195",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201803-561",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2018-5476",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2018-03-02T00:00:00",
"db": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-234",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-229",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-228",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-222",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-233",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-227",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-235",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-220",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-231",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-226",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-230",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-232",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-221",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-224",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-04098",
"ident": null
},
{
"date": "2018-03-01T00:00:00",
"db": "BID",
"id": "103195",
"ident": null
},
{
"date": "2018-03-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-561",
"ident": null
},
{
"date": "2018-03-15T23:29:00.470000",
"db": "NVD",
"id": "CVE-2018-5476",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-234",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-229",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-228",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-222",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-233",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-227",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-235",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-220",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-231",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-226",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-230",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-232",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-221",
"ident": null
},
{
"date": "2018-03-02T00:00:00",
"db": "ZDI",
"id": "ZDI-18-224",
"ident": null
},
{
"date": "2018-11-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-04098",
"ident": null
},
{
"date": "2018-03-01T00:00:00",
"db": "BID",
"id": "103195",
"ident": null
},
{
"date": "2020-09-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-561",
"ident": null
},
{
"date": "2024-11-21T04:08:52.697000",
"db": "NVD",
"id": "CVE-2018-5476",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-561"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "Delta Electronics Delta Industrial Automation DOPSoft Heap Buffer Overflow Vulnerability",
"sources": [
{
"db": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-04098"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "Buffer error",
"sources": [
{
"db": "IVD",
"id": "e2ff6511-39ab-11e9-8816-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-561"
}
],
"trust": 0.8
}
}
VAR-202407-0233
Vulnerability from variot - Updated: 2026-04-10 23:53Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. Delta Electronics CNCSoft-G2 is a human-machine interface (HMI) software from Delta Electronics, a Chinese company
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "cncsoft-g2",
"scope": null,
"trust": 11.9,
"vendor": "delta",
"version": null
},
{
"_id": null,
"model": "cncsoft-g2",
"scope": "eq",
"trust": 1.0,
"vendor": "deltaww",
"version": "2.0.0.5"
},
{
"_id": null,
"model": "electronics cncsoft-g2",
"scope": "eq",
"trust": 0.6,
"vendor": "delta",
"version": "2.0.0.5"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-944"
},
{
"db": "ZDI",
"id": "ZDI-24-943"
},
{
"db": "ZDI",
"id": "ZDI-24-940"
},
{
"db": "ZDI",
"id": "ZDI-24-937"
},
{
"db": "ZDI",
"id": "ZDI-24-936"
},
{
"db": "ZDI",
"id": "ZDI-24-935"
},
{
"db": "ZDI",
"id": "ZDI-24-939"
},
{
"db": "ZDI",
"id": "ZDI-24-938"
},
{
"db": "ZDI",
"id": "ZDI-24-934"
},
{
"db": "ZDI",
"id": "ZDI-24-932"
},
{
"db": "ZDI",
"id": "ZDI-24-930"
},
{
"db": "ZDI",
"id": "ZDI-24-928"
},
{
"db": "ZDI",
"id": "ZDI-24-925"
},
{
"db": "ZDI",
"id": "ZDI-24-924"
},
{
"db": "ZDI",
"id": "ZDI-24-922"
},
{
"db": "ZDI",
"id": "ZDI-24-918"
},
{
"db": "ZDI",
"id": "ZDI-24-920"
},
{
"db": "CNVD",
"id": "CNVD-2024-32986"
},
{
"db": "NVD",
"id": "CVE-2024-39880"
}
]
},
"credits": {
"_id": null,
"data": "Natnael Samson (@NattiSamson)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-937"
},
{
"db": "ZDI",
"id": "ZDI-24-936"
},
{
"db": "ZDI",
"id": "ZDI-24-935"
},
{
"db": "ZDI",
"id": "ZDI-24-939"
},
{
"db": "ZDI",
"id": "ZDI-24-938"
},
{
"db": "ZDI",
"id": "ZDI-24-934"
},
{
"db": "ZDI",
"id": "ZDI-24-932"
},
{
"db": "ZDI",
"id": "ZDI-24-930"
},
{
"db": "ZDI",
"id": "ZDI-24-928"
},
{
"db": "ZDI",
"id": "ZDI-24-925"
},
{
"db": "ZDI",
"id": "ZDI-24-924"
},
{
"db": "ZDI",
"id": "ZDI-24-922"
},
{
"db": "ZDI",
"id": "ZDI-24-918"
},
{
"db": "ZDI",
"id": "ZDI-24-920"
}
],
"trust": 9.8
},
"cve": "CVE-2024-39880",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2024-32986",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-39880",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 11.9,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2024-39880",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2024-39880",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2024-39880",
"trust": 11.9,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2024-39880",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2024-39880",
"trust": 1.0,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2024-32986",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-944"
},
{
"db": "ZDI",
"id": "ZDI-24-943"
},
{
"db": "ZDI",
"id": "ZDI-24-940"
},
{
"db": "ZDI",
"id": "ZDI-24-937"
},
{
"db": "ZDI",
"id": "ZDI-24-936"
},
{
"db": "ZDI",
"id": "ZDI-24-935"
},
{
"db": "ZDI",
"id": "ZDI-24-939"
},
{
"db": "ZDI",
"id": "ZDI-24-938"
},
{
"db": "ZDI",
"id": "ZDI-24-934"
},
{
"db": "ZDI",
"id": "ZDI-24-932"
},
{
"db": "ZDI",
"id": "ZDI-24-930"
},
{
"db": "ZDI",
"id": "ZDI-24-928"
},
{
"db": "ZDI",
"id": "ZDI-24-925"
},
{
"db": "ZDI",
"id": "ZDI-24-924"
},
{
"db": "ZDI",
"id": "ZDI-24-922"
},
{
"db": "ZDI",
"id": "ZDI-24-918"
},
{
"db": "ZDI",
"id": "ZDI-24-920"
},
{
"db": "CNVD",
"id": "CNVD-2024-32986"
},
{
"db": "NVD",
"id": "CVE-2024-39880"
},
{
"db": "NVD",
"id": "CVE-2024-39880"
}
]
},
"description": {
"_id": null,
"data": "Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. Delta Electronics CNCSoft-G2 is a human-machine interface (HMI) software from Delta Electronics, a Chinese company",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-39880"
},
{
"db": "ZDI",
"id": "ZDI-24-943"
},
{
"db": "ZDI",
"id": "ZDI-24-920"
},
{
"db": "ZDI",
"id": "ZDI-24-918"
},
{
"db": "ZDI",
"id": "ZDI-24-922"
},
{
"db": "ZDI",
"id": "ZDI-24-924"
},
{
"db": "ZDI",
"id": "ZDI-24-925"
},
{
"db": "ZDI",
"id": "ZDI-24-928"
},
{
"db": "ZDI",
"id": "ZDI-24-930"
},
{
"db": "ZDI",
"id": "ZDI-24-944"
},
{
"db": "ZDI",
"id": "ZDI-24-934"
},
{
"db": "ZDI",
"id": "ZDI-24-938"
},
{
"db": "ZDI",
"id": "ZDI-24-939"
},
{
"db": "ZDI",
"id": "ZDI-24-935"
},
{
"db": "ZDI",
"id": "ZDI-24-936"
},
{
"db": "ZDI",
"id": "ZDI-24-937"
},
{
"db": "ZDI",
"id": "ZDI-24-940"
},
{
"db": "ZDI",
"id": "ZDI-24-932"
},
{
"db": "CNVD",
"id": "CNVD-2024-32986"
}
],
"trust": 12.15
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2024-39880",
"trust": 13.5
},
{
"db": "ICS CERT",
"id": "ICSA-24-191-01",
"trust": 1.6
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23916",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-944",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23915",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-943",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23841",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-940",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23811",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-937",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23809",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-936",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23807",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-935",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23832",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-939",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23831",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-938",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23770",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-934",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23767",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-932",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23765",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-930",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23763",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-928",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23580",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-925",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23579",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-924",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23577",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-922",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23573",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-918",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-23575",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-24-920",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2024-32986",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-944"
},
{
"db": "ZDI",
"id": "ZDI-24-943"
},
{
"db": "ZDI",
"id": "ZDI-24-940"
},
{
"db": "ZDI",
"id": "ZDI-24-937"
},
{
"db": "ZDI",
"id": "ZDI-24-936"
},
{
"db": "ZDI",
"id": "ZDI-24-935"
},
{
"db": "ZDI",
"id": "ZDI-24-939"
},
{
"db": "ZDI",
"id": "ZDI-24-938"
},
{
"db": "ZDI",
"id": "ZDI-24-934"
},
{
"db": "ZDI",
"id": "ZDI-24-932"
},
{
"db": "ZDI",
"id": "ZDI-24-930"
},
{
"db": "ZDI",
"id": "ZDI-24-928"
},
{
"db": "ZDI",
"id": "ZDI-24-925"
},
{
"db": "ZDI",
"id": "ZDI-24-924"
},
{
"db": "ZDI",
"id": "ZDI-24-922"
},
{
"db": "ZDI",
"id": "ZDI-24-918"
},
{
"db": "ZDI",
"id": "ZDI-24-920"
},
{
"db": "CNVD",
"id": "CNVD-2024-32986"
},
{
"db": "NVD",
"id": "CVE-2024-39880"
}
]
},
"id": "VAR-202407-0233",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-32986"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-32986"
}
]
},
"last_update_date": "2026-04-10T23:53:35.760000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Delta Electronics has issued an update to correct this vulnerability.",
"trust": 11.9,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-01"
},
{
"title": "Patch for Delta Electronics CNCSoft-G2 Buffer Overflow Vulnerability (CNVD-2024-32986)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/571021"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-944"
},
{
"db": "ZDI",
"id": "ZDI-24-943"
},
{
"db": "ZDI",
"id": "ZDI-24-940"
},
{
"db": "ZDI",
"id": "ZDI-24-937"
},
{
"db": "ZDI",
"id": "ZDI-24-936"
},
{
"db": "ZDI",
"id": "ZDI-24-935"
},
{
"db": "ZDI",
"id": "ZDI-24-939"
},
{
"db": "ZDI",
"id": "ZDI-24-938"
},
{
"db": "ZDI",
"id": "ZDI-24-934"
},
{
"db": "ZDI",
"id": "ZDI-24-932"
},
{
"db": "ZDI",
"id": "ZDI-24-930"
},
{
"db": "ZDI",
"id": "ZDI-24-928"
},
{
"db": "ZDI",
"id": "ZDI-24-925"
},
{
"db": "ZDI",
"id": "ZDI-24-924"
},
{
"db": "ZDI",
"id": "ZDI-24-922"
},
{
"db": "ZDI",
"id": "ZDI-24-918"
},
{
"db": "ZDI",
"id": "ZDI-24-920"
},
{
"db": "CNVD",
"id": "CNVD-2024-32986"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-121",
"trust": 1.0
},
{
"problemtype": "CWE-787",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2024-39880"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 13.5,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-191-01"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-944"
},
{
"db": "ZDI",
"id": "ZDI-24-943"
},
{
"db": "ZDI",
"id": "ZDI-24-940"
},
{
"db": "ZDI",
"id": "ZDI-24-937"
},
{
"db": "ZDI",
"id": "ZDI-24-936"
},
{
"db": "ZDI",
"id": "ZDI-24-935"
},
{
"db": "ZDI",
"id": "ZDI-24-939"
},
{
"db": "ZDI",
"id": "ZDI-24-938"
},
{
"db": "ZDI",
"id": "ZDI-24-934"
},
{
"db": "ZDI",
"id": "ZDI-24-932"
},
{
"db": "ZDI",
"id": "ZDI-24-930"
},
{
"db": "ZDI",
"id": "ZDI-24-928"
},
{
"db": "ZDI",
"id": "ZDI-24-925"
},
{
"db": "ZDI",
"id": "ZDI-24-924"
},
{
"db": "ZDI",
"id": "ZDI-24-922"
},
{
"db": "ZDI",
"id": "ZDI-24-918"
},
{
"db": "ZDI",
"id": "ZDI-24-920"
},
{
"db": "CNVD",
"id": "CNVD-2024-32986"
},
{
"db": "NVD",
"id": "CVE-2024-39880"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "ZDI",
"id": "ZDI-24-944",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-943",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-940",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-937",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-936",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-935",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-939",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-938",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-934",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-932",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-930",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-928",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-925",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-924",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-922",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-918",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-24-920",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2024-32986",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2024-39880",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-944",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-943",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-940",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-937",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-936",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-935",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-939",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-938",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-934",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-932",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-930",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-928",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-925",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-924",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-922",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-918",
"ident": null
},
{
"date": "2024-07-22T00:00:00",
"db": "ZDI",
"id": "ZDI-24-920",
"ident": null
},
{
"date": "2024-07-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-32986",
"ident": null
},
{
"date": "2024-07-09T22:15:02.740000",
"db": "NVD",
"id": "CVE-2024-39880",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-944",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-943",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-940",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-937",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-936",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-935",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-939",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-938",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-934",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-932",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-930",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-928",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-925",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-924",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-922",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-918",
"ident": null
},
{
"date": "2024-08-15T00:00:00",
"db": "ZDI",
"id": "ZDI-24-920",
"ident": null
},
{
"date": "2024-07-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-32986",
"ident": null
},
{
"date": "2024-08-29T17:38:18.727000",
"db": "NVD",
"id": "CVE-2024-39880",
"ident": null
}
]
},
"title": {
"_id": null,
"data": "Delta Electronics CNCSoft-G2 DPAX File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-24-944"
},
{
"db": "ZDI",
"id": "ZDI-24-943"
},
{
"db": "ZDI",
"id": "ZDI-24-940"
},
{
"db": "ZDI",
"id": "ZDI-24-937"
},
{
"db": "ZDI",
"id": "ZDI-24-936"
},
{
"db": "ZDI",
"id": "ZDI-24-935"
},
{
"db": "ZDI",
"id": "ZDI-24-939"
},
{
"db": "ZDI",
"id": "ZDI-24-938"
},
{
"db": "ZDI",
"id": "ZDI-24-934"
},
{
"db": "ZDI",
"id": "ZDI-24-932"
},
{
"db": "ZDI",
"id": "ZDI-24-930"
},
{
"db": "ZDI",
"id": "ZDI-24-928"
},
{
"db": "ZDI",
"id": "ZDI-24-925"
}
],
"trust": 9.1
}
}
VAR-201805-1147
Vulnerability from variot - Updated: 2026-04-10 23:48WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash. Delta Electronics WPLSoft Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of dvp files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Delta Industrial Automation is the industry automation vendor for power management and cooling solutions worldwide. The length of the data provided by the user is not verified. WPLSoft (Delta PLC programming software) is a PLC program programming software used by Delta Electronics in the WINDOWS operating system environment. Delta Electronics WPLSoft has a heap buffer overflow vulnerability. Execute or cause the application to crash. A stack-based buffer-overflow vulnerability 2. A heap-based buffer-overflow vulnerability 3. Delta Industrial WPLSoft Version 2.45.0 and prior versions are vulnerable
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "wplsoft",
"scope": null,
"trust": 3.5,
"vendor": "delta industrial automation",
"version": null
},
{
"_id": null,
"model": "industrial automation wplsoft",
"scope": null,
"trust": 1.2,
"vendor": "delta",
"version": null
},
{
"_id": null,
"model": "wplsoft",
"scope": "lte",
"trust": 1.0,
"vendor": "deltaww",
"version": "2.45.0"
},
{
"_id": null,
"model": "electronics wplsoft",
"scope": "lte",
"trust": 0.8,
"vendor": "delta",
"version": "\u003c=2.45.0"
},
{
"_id": null,
"model": "industrial automation wplsoft",
"scope": "eq",
"trust": 0.8,
"vendor": "delta",
"version": "*"
},
{
"_id": null,
"model": "wplsoft",
"scope": "lte",
"trust": 0.8,
"vendor": "delta",
"version": "2.45.0"
},
{
"_id": null,
"model": "wplsoft",
"scope": "eq",
"trust": 0.6,
"vendor": "deltaww",
"version": "2.45.0"
},
{
"_id": null,
"model": "electronics inc wplsoft",
"scope": "eq",
"trust": 0.3,
"vendor": "delta",
"version": "2.45.0"
},
{
"_id": null,
"model": "electronics inc wplsoft",
"scope": "eq",
"trust": 0.3,
"vendor": "delta",
"version": "2.42.11"
},
{
"_id": null,
"model": "electronics inc wplsoft",
"scope": "eq",
"trust": 0.3,
"vendor": "delta",
"version": "2.0"
},
{
"_id": null,
"model": "electronics inc wplsoft",
"scope": "ne",
"trust": 0.3,
"vendor": "delta",
"version": "2.46.0"
}
],
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "BID",
"id": "103179"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "NVD",
"id": "CVE-2018-7507"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:delta_electronics:wplsoft",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
}
]
},
"credits": {
"_id": null,
"data": "axt",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
}
],
"trust": 3.5
},
"cve": "CVE-2018-7507",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2018-7507",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 3.3,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2018-7507",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 1.4,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.9,
"id": "CVE-2018-7507",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-22821",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2017-22824",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.7,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-03768",
"impactScore": 9.5,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.7,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1",
"impactScore": 9.5,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "e300285e-39ab-11e9-83a1-000c29342cb1",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2018-7507",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2018-7507",
"trust": 2.1,
"value": "MEDIUM"
},
{
"author": "ZDI",
"id": "CVE-2018-7507",
"trust": 1.4,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2018-7507",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-7507",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2017-22821",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-22824",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2018-03768",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201803-768",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2018-7507",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "VULMON",
"id": "CVE-2018-7507"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "NVD",
"id": "CVE-2018-7507"
}
]
},
"description": {
"_id": null,
"data": "WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash. Delta Electronics WPLSoft Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of dvp files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Delta Industrial Automation is the industry automation vendor for power management and cooling solutions worldwide. The length of the data provided by the user is not verified. WPLSoft (Delta PLC programming software) is a PLC program programming software used by Delta Electronics in the WINDOWS operating system environment. Delta Electronics WPLSoft has a heap buffer overflow vulnerability. Execute or cause the application to crash. A stack-based buffer-overflow vulnerability\n2. A heap-based buffer-overflow vulnerability\n3. \nDelta Industrial WPLSoft Version 2.45.0 and prior versions are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-7507"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "BID",
"id": "103179"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "VULMON",
"id": "CVE-2018-7507"
}
],
"trust": 7.65
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2018-7507",
"trust": 7.1
},
{
"db": "ICS CERT",
"id": "ICSA-18-058-02",
"trust": 3.4
},
{
"db": "BID",
"id": "103179",
"trust": 2.0
},
{
"db": "ZDI",
"id": "ZDI-17-705",
"trust": 1.3
},
{
"db": "ZDI",
"id": "ZDI-17-702",
"trust": 1.3
},
{
"db": "CNVD",
"id": "CNVD-2017-22821",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2017-22824",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2018-03768",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4442",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4436",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-17-703",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4441",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-17-704",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4439",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-17-699",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4440",
"trust": 0.7
},
{
"db": "IVD",
"id": "E3004F6E-39AB-11E9-A5A2-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "E3000150-39AB-11E9-9CA4-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "E4E1F909-5D49-466D-AC98-CDBBB329C50D",
"trust": 0.2
},
{
"db": "IVD",
"id": "E8DD53BE-8850-484E-AB8A-BC308C7F1C64",
"trust": 0.2
},
{
"db": "IVD",
"id": "E300285E-39AB-11E9-83A1-000C29342CB1",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2018-7507",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "VULMON",
"id": "CVE-2018-7507"
},
{
"db": "BID",
"id": "103179"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "NVD",
"id": "CVE-2018-7507"
}
]
},
"id": "VAR-201805-1147",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
}
],
"trust": 3.7166666666666663
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 2.8
}
],
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
}
]
},
"last_update_date": "2026-04-10T23:48:01.556000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Delta Industrial Automation has issued an update to correct this vulnerability. This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 120 day deadline.02/01/17 - ZDI disclosed reports to ICS-CERT02/07/17 - ICS-CERT provided ZDI with an ICS-VU # ICS-VU-97456803/16/17 - ICS-CERT asked ZDI questions about reproduction03/27/17 - ICS-CERT asked ZDI again some questions about reproduction06/07/17 - ICS-CERT offered ZDI a pre-release patch to test06/07/17 - ZDI replied that we cannot do the testing for the vendor07/20/17 - ZDI sent a mail to ICS-CERT asking the status07/26/17 - ICS-CERT advised that the vendor has a new version they believe addressed the reports (though to ZDI knowledge, no advisory was released)08/02/17 - ZDI advised ICS-CERT that our finder indicated that the vulnerabilities are still present08/11/17 - ZDI wrote ICS-CERT to indicate the intention to move these reports to 0-day on 8/24-- Mitigation:Given the nature of the vulnerability the only salient mitigation strategy is to restrict interaction with the application to trusted files.",
"trust": 3.5,
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-058-02"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.deltaww.com/"
},
{
"title": "Patch for Delta Industrial Automation WPLSoft dvp File Buffer Buffer Overflow Vulnerability (CNVD-2017-228214)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/143677"
},
{
"title": "Delta Industrial Automation WPLSoft dvp file heap buffer overflow vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/143683"
},
{
"title": "Patch for Delta Electronics WPLSoft Heap Buffer Overflow Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/119165"
},
{
"title": "Delta Electronics WPLSoft Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79354"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
},
{
"problemtype": "CWE-122",
"trust": 1.0
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "NVD",
"id": "CVE-2018-7507"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 7.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-058-02"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/103179"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7507"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-7507"
},
{
"trust": 0.6,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-702/"
},
{
"trust": 0.6,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-705/"
},
{
"trust": 0.3,
"url": "http://www.deltaww.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "VULMON",
"id": "CVE-2018-7507"
},
{
"db": "BID",
"id": "103179"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "NVD",
"id": "CVE-2018-7507"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1",
"ident": null
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1",
"ident": null
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d",
"ident": null
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64",
"ident": null
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-705",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-703",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-704",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-699",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-702",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2017-22821",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2017-22824",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2018-03768",
"ident": null
},
{
"db": "VULMON",
"id": "CVE-2018-7507",
"ident": null
},
{
"db": "BID",
"id": "103179",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2018-7507",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2018-02-28T00:00:00",
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1",
"ident": null
},
{
"date": "2017-08-24T00:00:00",
"db": "ZDI",
"id": "ZDI-17-705",
"ident": null
},
{
"date": "2017-08-24T00:00:00",
"db": "ZDI",
"id": "ZDI-17-703",
"ident": null
},
{
"date": "2017-08-24T00:00:00",
"db": "ZDI",
"id": "ZDI-17-704",
"ident": null
},
{
"date": "2017-08-24T00:00:00",
"db": "ZDI",
"id": "ZDI-17-699",
"ident": null
},
{
"date": "2017-08-24T00:00:00",
"db": "ZDI",
"id": "ZDI-17-702",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22821",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22824",
"ident": null
},
{
"date": "2018-02-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-03768",
"ident": null
},
{
"date": "2018-05-04T00:00:00",
"db": "VULMON",
"id": "CVE-2018-7507",
"ident": null
},
{
"date": "2018-02-27T00:00:00",
"db": "BID",
"id": "103179",
"ident": null
},
{
"date": "2018-03-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-768",
"ident": null
},
{
"date": "2018-06-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-004571",
"ident": null
},
{
"date": "2018-05-04T19:29:00.313000",
"db": "NVD",
"id": "CVE-2018-7507",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2018-03-28T00:00:00",
"db": "ZDI",
"id": "ZDI-17-705",
"ident": null
},
{
"date": "2018-03-28T00:00:00",
"db": "ZDI",
"id": "ZDI-17-703",
"ident": null
},
{
"date": "2018-03-28T00:00:00",
"db": "ZDI",
"id": "ZDI-17-704",
"ident": null
},
{
"date": "2018-03-28T00:00:00",
"db": "ZDI",
"id": "ZDI-17-699",
"ident": null
},
{
"date": "2018-03-28T00:00:00",
"db": "ZDI",
"id": "ZDI-17-702",
"ident": null
},
{
"date": "2018-11-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22821",
"ident": null
},
{
"date": "2018-11-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22824",
"ident": null
},
{
"date": "2018-11-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-03768",
"ident": null
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2018-7507",
"ident": null
},
{
"date": "2018-02-27T00:00:00",
"db": "BID",
"id": "103179",
"ident": null
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-768",
"ident": null
},
{
"date": "2018-06-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-004571",
"ident": null
},
{
"date": "2024-11-21T04:12:15.890000",
"db": "NVD",
"id": "CVE-2018-7507",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "(0Day) Delta Industrial Automation WPLSoft dvp File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
}
],
"trust": 2.8
},
"type": {
"_id": null,
"data": "Buffer error",
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
}
],
"trust": 0.8
}
}