The vulnerability arises from a missing check on the length of the buffer that stores a directory name. This omission can lead to a stack‑based buffer overflow (CWE‑121) if an attacker supplies an overly long directory name. Although the description does not explicitly detail the consequences, a typical overflow can overwrite return addresses or other control data, giving the attacker the possibility to execute arbitrary code on the device. The impact therefore includes potential compromise of the device’s confidentiality, integrity, and availability.

Delta Electronics AS320T network device, firmware versions prior to 1.12. The vendor lists the affected product as DeltaWW:AS320T; all releases before 1.12 are impacted.

The CVSS score of 9.8 indicates high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector would be through any interface that accepts directory names (e.g., file management or network interface) and could be remote if the device is exposed; however, the exact path is not specified.