Delta Electronics AS320T suffers from an incorrect buffer size calculation in the GET/PUT request handler of its web service, a classic stack-based buffer overflow flaw identified as CWE-131. The overflow can overwrite control data on the stack, permitting an attacker to inject and execute arbitrary code or crash the service, compromising the device’s confidentiality, integrity, and availability.

The vulnerability affects DeltaWW AS320T units running firmware versions older than v1.16. No specific older versions are listed, so all firmware prior to v1.16 is considered at risk.

The CVSS score of 9.8 indicates a critical severity, yet the EPSS score of less than 1% suggests a very low current exploitation probability. The flaw is not listed in CISA’s KEV catalog, but the remote nature of the web service means an attacker can target the device from the network where the service is exposed. Successful exploitation could grant full control over the device or cause a denial of service.