Delta DVP-12SE CVE-2025-62578

Exploitation requires the attacker to hold a position on the adjacent/same-layer-2 network segment as the DVP-12SE PLC (CVSS AV:A - not internet-routable), from which the device's Modbus/TCP service (typically TCP port 502) transmits sensitive information in cleartext with no encryption and no authentication (PR:N). No user interaction or special product configuration is needed - Modbus/TCP's lack of transport security is the default protocol behavior. The primary limiting factor is the adjacency requirement: an attacker cannot exploit this directly over the internet and must first breach or gain access to the OT/local network, which in well-segmented ICS environments substantially narrows the realistic attack surface.

This is a moderate-priority industrial control systems (ICS) flaw rather than an urgent internet-wide emergency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 7.2 (HIGH) and indicates an adjacent-network, low-complexity, unauthenticated attack requiring no user interaction - meaning any attacker who gains a foothold on the same local/OT network segment as the PLC can exploit it trivially. The AV:A (Adjacent) vector is the key risk-limiting signal: this is NOT remotely exploitable across the internet (not AV:N), so exploitation is gated on the attacker already having local network access to the OT environment. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' A notable internal tension exists in the vendor vector: the weakness is CWE-319 (Cleartext Transmission of Sensitive Information), which is fundamentally a confidentiality problem, yet the vendor rated VC:L (low confidentiality) but VI:H and VA:H (high integrity and availability impact). This implies the vendor views the unencrypted/unauthenticated Modbus/TCP channel as enabling not just passive sniffing but active injection/replay to manipulate or disrupt the PLC - verify this interpretation against the Delta advisory, as a pure cleartext-disclosure flaw would normally skew toward confidentiality rather than integrity/availability. Realistic risk is constrained by the ICS deployment context and adjacent-network requirement.

An attacker who has already gained access to the operational technology (OT) network segment hosting the DVP-12SE PLC passively intercepts Modbus/TCP traffic (typically TCP port 502), which is transmitted in cleartext without encryption or authentication. The captured sensitive information (and the ability to inject crafted Modbus requests on the unauthenticated channel) allows the attacker to read process data and manipulate the controller's integrity and availability. No public exploit code was identified in the provided data, but Modbus/TCP interception requires only commodity network-sniffing tooling.