Delta DVP-12SE11T CVE-2025-15102

Exploitation requires network access to the DVP-12SE11T PLC's engineering or communication interface, where an attacker abuses an alternate authentication path (CWE-288) to bypass the controller's password/program protection without credentials or user interaction. The practical limiting factor is reachability: as an industrial PLC, the device is typically deployed inside an OT/plant network, so exploitation is realistic only where that network is flat, remotely accessible, or bridged to IT - proper OT segmentation, firewalling of the controller port, or air-gapping substantially constrains the otherwise unauthenticated, low-complexity attack. Affected firmware version boundaries should be confirmed against Delta-PCSA-2025-00022.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a fully remote, unauthenticated, low-complexity authentication bypass (CWE-288) that grants complete confidentiality, integrity, and availability impact over the DVP-12SE11T PLC - meaning an attacker can bypass the program/password protection intended to guard the controller's ladder logic and configuration. Against these numeric-severity signals, the real-world exploitation signals are absent from the input: no EPSS probability, no CISA KEV listing (so per the precision rules this is 'no public exploit identified at time of analysis'), no POC, and no SSVC decision data are provided. There is a latent tension between the AV:N rating and typical OT reality: DVP-series PLCs are industrial controllers that are frequently deployed on segmented or air-gapped OT networks rather than the open internet, so the practical attack surface is usually narrower than the 9.8/AV:N score implies - the score assumes direct network reachability that a defended plant may not expose. Treat this as a high-severity design flaw that becomes an urgent priority only where the PLC's engineering/communication port is reachable by an attacker (flat networks, exposed remote-access, or internet-facing HMIs); where OT segmentation is enforced, the residual risk is materially lower than the base score suggests. Vendor advisory confirmation of affected versions and fix should be verified in Delta-PCSA-2025-00022.

An attacker with network reach to the DVP-12SE11T's engineering/communication interface issues crafted protocol requests that circumvent the controller's password protection (CWE-288), gaining access without valid credentials. Because the flaw is remote, unauthenticated, and low-complexity, the attacker can then read the proprietary control logic and overwrite program or configuration values, altering the industrial process. No public proof-of-concept is identified at time of analysis.