Delta DVP-12SE11T CVE-2025-15103

Exploitation requires network reachability to the DVP-12SE11T's authentication-protected management interface; the attacker leverages an improper partial disclosure of password material to bypass authentication (PR:N, UI:N per CVSS - no valid credentials or user interaction needed). The principal limiting factor is network exposure: Delta DVP-series PLCs are typically deployed on segmented OT/control networks, so realistic risk depends on whether the device's network services are exposed to the attacker's segment or, worse, internet-facing. No non-default configuration is stated as required.

The vendor/NVD CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) rates this as critical: network-reachable, low-complexity, unauthenticated, full CIA impact. The mechanism is a partial password disclosure (CWE-200) that enables an authentication bypass - an information leak that collapses into full control of the PLC. However, no EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no signal of active or automated exploitation; SSVC decision inputs (exploitation status, automatable) are absent. The 9.8 is therefore a capability-based ceiling: real-world exposure hinges on whether the DVP-12SE11T's management/authentication interface is actually reachable over the network, which for a Delta industrial PLC is often an isolated OT segment rather than the open internet. Treat as HIGH priority for asset owners who expose this PLC's network services, but the low real-world prevalence of the specific product and the lack of any exploitation telemetry temper the practical urgency relative to the raw score. Note the tension: CVSS AV:N assumes network reachability, while PLCs are frequently deployed on segmented control networks - verify actual network exposure before prioritizing.

An attacker with network access to the DVP-12SE11T's authentication interface queries or observes the login mechanism and recovers partial password material that is improperly disclosed, then leverages that leak to bypass authentication entirely and gain control of the PLC. Because CVSS indicates PR:N and UI:N, no credentials or victim interaction are needed once the interface is reachable. No public exploit code was identified in the provided data.