Delta DVP80ES3 CVE-2026-12576

Exploitation requires network reachability to the DVP80ES3's communication channel and the ability to send messages the device will process - the vulnerability lies in the absence of message-integrity enforcement on that channel, so no valid credentials or user interaction are needed (PR:N/UI:N/AC:L). The primary limiting factor is network position: the attacker must be able to route traffic to the PLC's control/engineering protocol, which in correctly segmented ICS deployments is confined to the OT network and unreachable from IT or the internet. No non-default configuration or specific platform beyond the DVP80ES3 controller is indicated by the available data; confirmed impact is availability loss rather than code execution.

The vendor-assigned CVSS 3.1 base score is 7.5 (High) driven entirely by availability (A:H) over an easily reachable network path (AV:N/AC:L/PR:N/UI:N) - a clean, low-barrier profile. Countervailing signals lower the urgency: there is no EPSS score provided, no proof-of-concept, and no CISA KEV listing, so there is no evidence of active or automated exploitation. A notable inconsistency exists between the intelligence tags, which label this 'Information Disclosure,' and the CVSS vector, which shows C:N (no confidentiality impact) and A:H - verify with the Delta advisory which is authoritative, as CWE-924 could plausibly enable tampering (integrity) or disclosure depending on channel specifics not captured in the vector. Because this is an ICS/OT device, real-world risk is governed less by internet-scale exploitation probability and more by network segmentation: if the PLC network is properly isolated the exposure is limited, but a flat network makes it a high-value disruption target.

An attacker who gains a foothold on the OT network - via a compromised HMI, engineering laptop, or an insufficiently segmented IT/OT boundary - sends crafted or tampered protocol messages to the DVP80ES3 that it fails to validate for integrity. Because no authentication or user interaction is required (PR:N/UI:N), the malformed traffic drives the controller into a fault or unresponsive state, halting the automated process it manages. No public proof-of-concept is currently available, but the low attack complexity means a knowledgeable attacker with network access could reliably reproduce the availability impact.