CVE-2026-3630

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3630", "assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "state": "PUBLISHED", "assignerShortName": "Deltaww", "dateReserved": "2026-03-06T06:46:14.151Z", "datePublished": "2026-03-09T02:49:40.162Z", "dateUpdated": "2026-03-09T18:27:58.403Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "COMMGR2", "vendor": "DeltaWW", "versions": [{"lessThanOrEqual": "2.11.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:commgr2:*:*:windows:*:*:*:*:*", "versionEndIncluding": "2.11.0", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "reporter", "value": "Tenable"}], "datePublic": "2026-03-09T02:22:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Delta Electronics COMMGR2 has \n\nStack-based Buffer Overflow vulnerability."}], "value": "Delta Electronics COMMGR2 has \n\nStack-based Buffer Overflow vulnerability."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "cwe-121 Stack-based Buffer Overflow", "lang": "en"}]}], "providerMetadata": {"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "shortName": "Deltaww", "dateUpdated": "2026-03-09T02:49:40.162Z"}, "references": [{"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00005_COMMGR%202%20Multiple%20Vulnerabilities%20(CVE-2026-3630,%20CVE-2026-3631).pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Please download and upgrade COMMGR2 to v2.11.1 or later."}], "value": "Please download and upgrade COMMGR2 to v2.11.1 or later."}], "source": {"discovery": "EXTERNAL"}, "title": "Stack-based Buffer Overflow Vulnerability in COMMGR2", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T18:27:47.282342Z", "id": "CVE-2026-3630", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:27:58.403Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T18:27:47.282342Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:27:54.248Z"}}], "cna": {"title": "Stack-based Buffer Overflow Vulnerability in COMMGR2", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Tenable"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "DeltaWW", "product": "COMMGR2", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.11.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please download and upgrade COMMGR2 to v2.11.1 or later.", "supportingMedia": [{"type": "text/html", "value": "Please download and upgrade COMMGR2 to v2.11.1 or later.", "base64": false}]}], "datePublic": "2026-03-09T02:22:00.000Z", "references": [{"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00005_COMMGR%202%20Multiple%20Vulnerabilities%20(CVE-2026-3630,%20CVE-2026-3631).pdf"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Delta Electronics COMMGR2 has \n\nStack-based Buffer Overflow vulnerability.", "supportingMedia": [{"type": "text/html", "value": "Delta Electronics COMMGR2 has \n\nStack-based Buffer Overflow vulnerability.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "cwe-121 Stack-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:commgr2:*:*:windows:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.11.0", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "shortName": "Deltaww", "dateUpdated": "2026-03-09T02:49:40.162Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3630", "state": "PUBLISHED", "dateUpdated": "2026-03-09T18:27:58.403Z", "dateReserved": "2026-03-06T06:46:14.151Z", "assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "datePublished": "2026-03-09T02:49:40.162Z", "assignerShortName": "Deltaww"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "COMMGR2", "vendor": "DeltaWW", "versions": [{"lessThanOrEqual": "2.11.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "759f5e80-c8e1-4224-bead-956d7b33c98b"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:commgr2:*:*:*:*:*:*:*:*", "matchCriteriaId": "4BC8FE30-5861-4F92-9275-E754227B7279", "versionEndExcluding": "2.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Delta Electronics COMMGR2 has \n\nStack-based Buffer Overflow vulnerability."}, {"lang": "es", "value": "Delta Electronics COMMGR2 tiene vulnerabilidad de desbordamiento de b\u00fafer basado en pila."}], "id": "CVE-2026-3630", "lastModified": "2026-06-17T10:43:53.580", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3630", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T18:27:47.282342Z", "version": "2.0.3"}}]}, "published": "2026-03-09T04:15:58.373", "references": [{"source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "tags": ["Vendor Advisory"], "url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00005_COMMGR%202%20Multiple%20Vulnerabilities%20(CVE-2026-3630,%20CVE-2026-3631).pdf"}], "sourceIdentifier": "759f5e80-c8e1-4224-bead-956d7b33c98b", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.11.0]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "commgr2", "vendor": "deltaww"}], "analysis": {"en": {"generated_at": "2026-04-16T10:24:13.081148+00:00", "value": {"mitigation_remediation": ["Upgrade COMMGR2 to version 2.11.1 or later as advised by Delta Electronics", "If an upgrade is not immediately possible, restrict access to COMMGR2\u2019s management interface to trusted networks only and monitor for anomalous traffic patterns that might indicate exploit attempts", "Apply generic input validation and bounds\u2011checking practices to any custom extensions or configurations that interface with COMMGR2, as the underlying weakness is a lack of proper size checks (CWE\u2011787)"], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All versions of DeltaWW COMMGR2 prior to v2.11.1 are potentially affected; the vendor recommends upgrading to v2.11.1 or later for a fix. No further version granularity is provided in the data, so any older build should be considered vulnerable.", "description_and_impact": "Delta Electronics COMMGR2 contains a stack-based buffer overflow that can allow an attacker to overwrite return addresses and arbitrary memory locations. Based on the vulnerability type and the corresponding CWE classification, the impact is high\u2011severity; an attacker who can trigger the overflow could potentially execute arbitrary code with the privileges of the COMMGR2 process, leading to full system compromise. The description explicitly states a stack-based buffer overflow, but does not detail the exact trigger conditions, so it is inferred that the flaw is exploitable when input data exceeds expected bounds.", "risk_and_exploitability": "The CVSS score of 9.8 places this flaw in the critical range, though the EPSS score of less than 1% indicates that the likelihood of exploitation is currently low. The vulnerability is not listed in CISA's KEV catalog, suggesting no known active exploitation campaigns yet. The likely attack vector is through the application\u2019s handling of external input\u2014an attacker could send oversized or malformed data to the COMMGR2 service, trigger the overflow, and execute malicious code; this inference is based on the described stack buffer overflow."}}}}, "created": "2026-03-10T14:10:29.037914+00:00", "updated": "2026-04-16T10:30:16.172491+00:00", "vendors": ["deltaww", "deltaww$PRODUCT$commgr2"]}