What is the CVSS score of CVE-2025-15358?

CVE-2025-15358 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2025-15358?

Within 24 hours, inventory all Delta Electronics DVP-12SE11T PLCs and confirm which are reachable from any non-OT network segment; block or disable the exposed network service at the firewall or switch level where the device does not need to be remotely accessible, and restrict access to only explicitly required authorized hosts. Within 7 days, engage Delta Electronics support to obtain a firm patch timeline and any interim firmware guidance, verify that no observed firmware version is exposed to untrusted networks, and enable logging and alerting on the affected service to detect abnormal traffic or controller crash/restart events. Within 30 days, complete network segmentation or air-gap enforcement for all affected devices, document compensating controls and a recovery procedure for controller outages, and schedule re-assessment for a vendor patch release since no fixed version is available at this time.

Delta DVP-12SE11T CVE-2025-15358

HIGH

Improper Input Validation (CWE-20)

2025-12-30 759f5e80-c8e1-4224-bead-956d7b33c98b

Denial Of Service Deltaww Delta Electronics Dvp 12Se11T Firmware

7.5

CVSS 3.1 · Vendor: 759f5e80-c8e1-4224-bead-956d7b33c98b

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach PLC on OT network
Delivery

Send crafted malformed packet
Exploit

Trigger input-validation failure (CWE-20)
Execution

Controller crashes or hangs
Impact

Loss of process availability

Vulnerability Assessment

Weakness	CWE CWE-20 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions	Exploitation requires network reachability to the DVP-12SE11T PLC's exposed service; no authentication, privileges, or user interaction are needed (PR:N/UI:N) against the device as deployed. The practical limiting factor is network exposure: PLCs are normally intended to sit on segmented/air-gapped OT networks, so reachability from an attacker's position - not any software precondition - is the primary barrier. Impact is confined to availability (device crash/denial of service); no confidentiality or integrity compromise results. The exact vulnerable protocol/service is not specified in the available data and should be confirmed via Delta advisory Delta-PCSA-2025-00022.
Impact	Signals are consistent and point to a moderate, availability-only risk rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, which on paper is attractive to attackers; however impact is strictly A:H with C:N/I:N, so the worst outcome is loss of availability (device crash/hang), not data theft or code execution. EPSS is low at 0.32% (23rd percentile), the CVE is NOT on CISA KEV, and no public POC is referenced - so there is no evidence of active or imminent widespread exploitation. The real-world priority is driven less by the raw 7.5 score and more by deployment context: the affected DVP-12SE11T is a Delta Electronics PLC (OT/ICS asset), where even a pure DoS can halt a physical process and carry outsized operational/safety consequences. Note a data gap: CWE-20 (improper input validation) and the terse description give no detail on WHICH network service/protocol is vulnerable - verify the exact affected service and firmware versions with the Delta advisory (Delta-PCSA-2025-00022).
Exploit ScenarioDerived	An attacker with network access to the PLC's control network sends a malformed or unexpected packet to the device's exposed service, triggering the input-validation flaw and causing the controller to crash or become unresponsive. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, a single crafted request can disrupt the monitored or controlled physical process. No public exploit code is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 05, 2026

Denial of service in Delta Electronics DVP-12SE11T PLC firmware lets an unauthenticated, remote attacker crash or otherwise render the device unavailable (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The vulnerability stems from improper input validation (CWE-20) in the device's exposed network service, and the CPE entry cpe:2.3:o:deltaww:dvp-12se11t_firmware:* indicates all observed firmware versions are affected. Risk is moderate rather than critical: EPSS is 0.32% (23rd percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and the practical barrier is network reachability - the device is normally deployed inside segmented or air-gapped OT networks, where no authentication or user interaction is required once the attacker can reach the service.

RemediationAI

No vendor-released patch version is identified in the available data, so the first action is to consult Delta's advisory Delta-PCSA-2025-00022 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00022_DVP-12SE11T%20Multiple%20Vulnerabilities.pdf) for the fixed firmware build and update procedure, then schedule the firmware upgrade during a maintenance window since flashing a PLC interrupts the controlled process. Until a patched build is applied, treat the controller as untrusted on any shared network: place the DVP-12SE11T on an isolated OT VLAN or fully air-gapped segment, and permit traffic only from the specific engineering workstations and HMI/SCADA hosts that must poll it - the trade-off is that remote diagnostics, cloud telemetry and vendor support access stop working unless routed through a hardened jump host or OT gateway. Block inbound access to the device's management/programming service from IT, guest and internet-facing networks at the perimeter firewall, and never port-forward it directly; a side effect is that any legitimate remote-engineering workflow will need an authenticated VPN or serial/local access instead. Disable or filter any unused network services on the unit if the firmware exposes toggles for them, accepting the loss of those functions. Because the failure mode is a crash, add availability monitoring (ICMP/Modbus or protocol health checks with alerting on device restart) so repeated or patterned denial-of-service attempts are detected quickly, and log source IPs for the device's service to correlate attack traffic and support containment.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the firmware of the Delta Electronics DVP-12SE11T, a programmable logic controller (CPE cpe:2.3:o:deltaww:dvp-12se11t_firmware:*:*:*:*:*:*:*:*). The root cause class is CWE-20 Improper Input Validation: the device does not adequately validate input received over its network-facing service, so a crafted request triggers a failure condition that terminates or hangs the process and takes the controller offline. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the attack is network-reachable, requires no authentication or privileges and no user interaction, and produces a high availability impact while confidentiality and integrity remain unaffected - i.e., this is a pure crash/DoS condition, not a code-execution or data-manipulation primitive. The single reference is Delta's own security advisory, Delta-PCSA-2025-00022 (a PDF hosted on filecenter.deltaww.com) titled 'DVP-12SE11T Multiple Vulnerabilities', which is the authoritative source for the specific vulnerable protocol/service and port; that detail is not present in the available intelligence and should be confirmed from the advisory before building detection signatures.

Know when Dvp 12Se11T Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (759f5e80-c8e1-4224-bead-956d7b33c98b) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Unauthenticated network input-validation flaw (AV:N/AC:L/PR:N/UI:N) causing device crash only, so A:H with C:N/I:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (759f5e80-c8e1-4224-bead-956d7b33c98b).

CVSS VectorVendor: 759f5e80-c8e1-4224-bead-956d7b33c98b

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

DVP-12SE11T - Denial of Service Vulnerability

Executive ViewAI

Why It Matters

Delta Electronics DVP-12SE11T PLCs running any observed firmware version are exposed to a remotely reachable denial-of-service condition that can crash or take the controller offline without authentication. Because these devices typically sit in segmented or air-gapped OT networks, the immediate organizational exposure is concentrated in plants, utilities, and other industrial sites where controller availability directly supports physical processes. No vendor patch is currently available, so leadership should treat this as a resilience and segmentation priority rather than a routine patching item, and verify that network boundaries actually prevent untrusted access to the device's exposed service.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include blocking remote access to the exposed network service, placing DVP-12SE11T controllers behind strict OT segmentation or air gaps, restricting access to authorized hosts only, monitoring for abnormal traffic or unexpected controller restarts, and preparing manual recovery/restart procedures.

Threat Intelligence Overview

EPSS Score

0.3%

Top 77% exploitable

Prevalence

Low

Industry-specific Delta PLC firmware, niche OT/ICS deployment footprint

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.