Delta DVP15MC11T CVE-2025-59301

Exploitation requires network reachability to the DVP15MC11T's Modbus/TCP interface (standard TCP port 502), which by protocol design is unauthenticated (consistent with PR:N) and works against default configurations since Modbus/TCP provides no native access control. The concrete prerequisite is that the controller's Modbus/TCP service be reachable from the attacker's network position. The primary limiting factor is deployment exposure: these controllers normally sit on segmented OT/ICS networks, so risk is sharply lower where the device is not routable from untrusted or corporate networks; there is no user-interaction, authentication, or non-default-feature requirement to overcome.

Signals are largely consistent and point to a moderate, not critical, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw whose sole impact is availability - denial of service with no confidentiality or integrity loss, which is why the score caps at High rather than Critical. EPSS is low at 0.22% (12th percentile), the CVE is NOT on the CISA KEV list, and no public exploit was identified, so there is no evidence of active or imminent widespread exploitation. The signals do not conflict: a network-exploitable DoS in an industrial motion controller is realistic but the low EPSS and absence of POC/KEV argue against treating this as an emergency. The key nuance is operational context rather than data conflict - Modbus/TCP is an unauthenticated protocol by design, so the PR:N rating is credible, and the real-world risk is governed almost entirely by whether the device's Modbus/TCP interface (typically TCP/502) is exposed beyond a segmented OT network. No required-data conflicts were found between the CVSS vector and the description; both agree on an unauthenticated network DoS.

An attacker with network reachability to the DVP15MC11T's Modbus/TCP service sends a malformed or malformed-sequence Modbus/TCP packet that the firmware fails to validate (CWE-20), causing the controller to crash or hang. Because Modbus/TCP requires no authentication and the attack complexity is low, a single crafted packet from any host able to reach TCP/502 can halt the controller, disrupting the physical process it governs. No public exploit code was identified at time of analysis.