Delta Electronics: Delta Electronics COMMGR2: Unauthenticated Stack-Based Buffer Overflow Enabling RCE

Impact

Per Praetorian’s blog: COMMGR2 “is commonly deployed in industrial automation environments, including manufacturing, building automation, energy, and logistics sectors” and “typically runs on engineering workstations and servers that support Delta’s industrial control systems and automation equipment.” Praetorian’s blog: “Industrial environments where COMMGR2 is installed on operator or engineering workstations may face particular risk, as successful exploitation could potentially enable attackers to pivot into operational technology (OT) networks or manipulate industrial control configurations.” Praetorian notes “No evidence of active exploitation in the wild” at time of publication.

Severity Rationale

Per Praetorian’s blog: “The CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N indicates this is a network-accessible flaw with low attack complexity. It requires no privileges or user interaction. As a result, it earns a Critical 9.8 rating.”

Fix

Per Praetorian’s blog: “Delta Electronics has released a Product Cybersecurity Advisory (Delta-PCSA-2026-00005) addressing this vulnerability alongside CVE-2026-3631, indicating joint disclosure of multiple COMMGR2 security issues.”