CVE-2026-3631

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3631", "assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "state": "PUBLISHED", "assignerShortName": "Deltaww", "dateReserved": "2026-03-06T06:46:15.699Z", "datePublished": "2026-03-09T02:56:06.391Z", "dateUpdated": "2026-03-09T18:27:33.129Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "COMMGR2", "vendor": "DeltaWW", "versions": [{"lessThanOrEqual": "2.11.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:commgr2:*:*:windows:*:*:*:*:*", "versionEndIncluding": "2.11.0", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "reporter", "value": "Tenable"}], "datePublic": "2026-03-09T02:22:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Delta Electronics COMMGR2 has \n\nBuffer Over-read DoS vulnerability."}], "value": "Delta Electronics COMMGR2 has \n\nBuffer Over-read DoS vulnerability."}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "shortName": "Deltaww", "dateUpdated": "2026-03-09T02:56:06.391Z"}, "references": [{"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00005_COMMGR%202%20Multiple%20Vulnerabilities%20(CVE-2026-3630,%20CVE-2026-3631).pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Please download and upgrade COMMGR2 to v2.11.1 or later."}], "value": "Please download and upgrade COMMGR2 to v2.11.1 or later."}], "source": {"discovery": "EXTERNAL"}, "title": "Buffer Over-read DoS Vulnerability in COMMGR2", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T18:27:23.503674Z", "id": "CVE-2026-3631", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:27:33.129Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3631", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T18:27:23.503674Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:27:29.571Z"}}], "cna": {"title": "Buffer Over-read DoS Vulnerability in COMMGR2", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Tenable"}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "DeltaWW", "product": "COMMGR2", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.11.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please download and upgrade COMMGR2 to v2.11.1 or later.", "supportingMedia": [{"type": "text/html", "value": "Please download and upgrade COMMGR2 to v2.11.1 or later.", "base64": false}]}], "datePublic": "2026-03-09T02:22:00.000Z", "references": [{"url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00005_COMMGR%202%20Multiple%20Vulnerabilities%20(CVE-2026-3630,%20CVE-2026-3631).pdf"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Delta Electronics COMMGR2 has \n\nBuffer Over-read DoS vulnerability.", "supportingMedia": [{"type": "text/html", "value": "Delta Electronics COMMGR2 has \n\nBuffer Over-read DoS vulnerability.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:commgr2:*:*:windows:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.11.0", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "shortName": "Deltaww", "dateUpdated": "2026-03-09T02:56:06.391Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3631", "state": "PUBLISHED", "dateUpdated": "2026-03-09T18:27:33.129Z", "dateReserved": "2026-03-06T06:46:15.699Z", "assignerOrgId": "759f5e80-c8e1-4224-bead-956d7b33c98b", "datePublished": "2026-03-09T02:56:06.391Z", "assignerShortName": "Deltaww"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "COMMGR2", "vendor": "DeltaWW", "versions": [{"lessThanOrEqual": "2.11.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "759f5e80-c8e1-4224-bead-956d7b33c98b"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deltaww:commgr2:*:*:*:*:*:*:*:*", "matchCriteriaId": "4BC8FE30-5861-4F92-9275-E754227B7279", "versionEndExcluding": "2.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Delta Electronics COMMGR2 has \n\nBuffer Over-read DoS vulnerability."}, {"lang": "es", "value": "Delta Electronics COMMGR2 tiene una vulnerabilidad de DoS por desbordamiento de lectura de b\u00fafer."}], "id": "CVE-2026-3631", "lastModified": "2026-06-17T10:43:53.683", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3631", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T18:27:23.503674Z", "version": "2.0.3"}}]}, "published": "2026-03-09T04:15:58.630", "references": [{"source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "tags": ["Vendor Advisory"], "url": "https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00005_COMMGR%202%20Multiple%20Vulnerabilities%20(CVE-2026-3630,%20CVE-2026-3631).pdf"}], "sourceIdentifier": "759f5e80-c8e1-4224-bead-956d7b33c98b", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "759f5e80-c8e1-4224-bead-956d7b33c98b", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.11.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "commgr2", "vendor": "deltaww"}], "analysis": {"en": {"generated_at": "2026-04-17T11:56:57.284563+00:00", "value": {"mitigation_remediation": ["Download and install Delta Electronics COMMGR2 version 2.11.1 or later to replace the vulnerable binaries.", "Replace the existing COMMGR2 executables and configuration data with the upgraded package, ensuring the old files are removed or secured.", "Restart the COMMGR2 service to load the patched version and verify that the service is running correctly.", "Continuously monitor system logs and network traffic for repeated over\u2011read attempts, and apply any additional vendor advisories when released."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via buffer over-read"}, "threat_synthesis": {"affected_systems": "DeltaWW COMMGR2 is affected on all platforms supported by Delta, including Windows variants. Any deployment of COMMGR2 prior to version 2.11.1 is vulnerable; the vendor recommends upgrading to v2.11.1 or later to receive the fix.", "description_and_impact": "Delta Electronics COMMGR2 suffers a buffer over-read that can be exploited to trigger a denial\u2011of\u2011service condition. The flaw allows an attacker to cause the application to read beyond the end of a buffer, leading to a crash or abrupt termination of the COMMGR2 process. The vulnerability maps to CWE\u2011125, a classic input validation failure. As the issue is not tied to authentication or privilege escalation, the impact is strictly limited to availability of the affected service.", "risk_and_exploitability": "The CVSS base score of 7.5 signals high severity, driven by the low difficulty to exploit the buffer over-read once the attacker gains network access to the COMMGR2 process. EPSS indicates a probability of less than 1%, suggesting that while exploitation events are uncommon, they are possible. The vulnerability is not listed in the CISA KEV catalog, limiting evidence of widespread attacks. The likely attack path involves network contact with the exposed service; this conclusion is inferred from the description and is not explicitly confirmed. The attack could be performed without special credentials, presenting a significant DoS threat."}}}}, "created": "2026-03-10T14:10:27.906018+00:00", "updated": "2026-04-17T12:00:11.793133+00:00", "vendors": ["deltaww", "deltaww$PRODUCT$commgr2"]}