EUVD-2026-40930
GHSA-vw8f-j9f7-vf48
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable resource-release flaw with low complexity; impact is a PLC crash, so availability-only (A:H) with no confidentiality or integrity effect.
Primary rating from Vendor (Deltaww).
CVSS VectorVendor: Deltaww
Lifecycle Timeline
1DescriptionCVE.org
DVP80ES3 with Improper Resource Shutdown or Release vulnerability.
AnalysisAI
Denial of service in Delta Electronics DVP80ES3 programmable logic controllers arises from an improper resource shutdown or release flaw (CWE-404) that lets remote unauthenticated attackers exhaust or corrupt device resources. Per the CVSS vector the impact is limited to availability (A:H) with no confidentiality or integrity loss, meaning a successful attacker can crash or hang the PLC and disrupt the controlled industrial process. No public exploit identified at time of analysis; the issue is documented in Delta advisory Delta-PCSA-2026-00009, which bundles it with CVE-2026-12576 and CVE-2026-12577.
Technical ContextAI
The affected product is the Delta DVP80ES3, part of Delta's DVP-ES3 series compact programmable logic controllers used in factory automation and machine control. The root cause is CWE-404 (Improper Resource Shutdown or Release): the firmware fails to properly free, close, or reclaim a resource - such as a network socket, memory buffer, or connection handle - after it is finished with it. Over repeated network interactions this can lead to resource exhaustion (leaked handles/memory) or an inconsistent internal state that terminates a service. The CPE cpe:2.3:a:deltaww:dvp80es3:*:*:*:*:*:*:*:* identifies the DVP80ES3 across all versions, consistent with a firmware-level defect in the PLC's networking or protocol-handling stack.
RemediationAI
Consult Delta advisory Delta-PCSA-2026-00009 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00009_DVP80ES3%20Multiple%20Vulnerabilities_v1%20(CVE-2026-12575,%2012576,%2012577).pdf) for the vendor's recommended firmware update; the provided data does not include an exact fixed version, so no vendor-released patch version can be independently confirmed at time of analysis - verify the target firmware level directly against that advisory. Because the attack vector is network-based (AV:N) and unauthenticated (PR:N), the most effective compensating control is network isolation: place the DVP80ES3 behind an OT firewall and restrict access to its control/engineering protocol ports to a whitelist of trusted engineering workstations, which blocks remote reachability at the cost of requiring VPN/jump-host access for legitimate remote maintenance. Additionally, disable or block exposure of any unused network services on the PLC and monitor for abnormal connection churn or repeated malformed requests indicative of a resource-exhaustion attempt; the trade-off of aggressive connection filtering is potential disruption to legitimate SCADA/HMI polling if not scoped carefully.
Denial-of-service exposure in the Delta Electronics DVP80ES3 programmable logic controller (part of the DVP-ES3 series)
Denial of service in Delta Electronics DVP80ES3 programmable logic controllers arises from a failure to enforce message
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today