CVE-2026-1949 is a critical vulnerability in the Delta Electronics AS320T product, specifically in the GET/PUT request handler of its web service. The issue arises from incorrect calculation of buffer size on the stack, classified under CWE-131. This miscalculation can lead to buffer overflows or similar memory corruption issues, potentially allowing an attacker to execute arbitrary code or cause denial of service. The vulnerability has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is remotely exploitable without privileges or user interaction and results in high impact to confidentiality, integrity, and availability. The product is cloud-hosted, and the vendor manages remediation.

Successful exploitation of this vulnerability can lead to complete compromise of the affected system's confidentiality, integrity, and availability. Given the vulnerability affects a cloud service, attackers could remotely execute arbitrary code or disrupt service availability. No known exploits are currently reported in the wild.

A patch is available for this vulnerability. Since the affected product is a cloud-hosted service, the vendor manages remediation on the server side. Users should verify with the vendor advisory that the patch has been applied or that the service is updated to a secure version. Patch status is confirmed as available but check the vendor advisory for deployment details.