EUVD-2026-40932
GHSA-7fmx-whj8-2pcw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated, low-complexity per the vendor 4.0 vector; scored impact is availability-only (A:H) with no confidentiality or integrity effect, consistent with a DoS on the PLC.
Primary rating from Vendor (Deltaww).
CVSS VectorVendor: Deltaww
Lifecycle Timeline
1DescriptionCVE.org
DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.
AnalysisAI
Denial-of-service exposure in the Delta Electronics DVP80ES3 programmable logic controller (part of the DVP-ES3 series) stems from an improperly implemented standard security check (CWE-358) that a remote, unauthenticated attacker can abuse over the network to force a loss of availability. The CVSS 4.0 base score is 8.7 (High), driven entirely by high availability impact with no confidentiality or integrity impact in the scored vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the vendor's tags label this 'Information Disclosure,' which conflicts with the availability-only CVSS vector and should be verified against the Delta advisory.
Technical ContextAI
The affected device is a Delta DVP80ES3, an industrial programmable logic controller (PLC) from the DVP-ES3 slim-type series used in factory/OT automation, identified by CPE cpe:2.3:a:deltaww:dvp80es3. The root cause is classified as CWE-358 (Improperly Implemented Security Check for Standard), meaning a security control the device is supposed to enforce according to a standard or specification is implemented incompletely or incorrectly, allowing the intended protection to be bypassed or subverted. Because PLCs typically expose fieldbus/industrial protocols and management services over the network, a flawed security check in that stack can be reached remotely as reflected by the AV:N (network) attack vector.
RemediationAI
Consult Delta advisory Delta-PCSA-2026-00009 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00009_DVP80ES3%20Multiple%20Vulnerabilities_v1%20(CVE-2026-12575,%2012576,%2012577).pdf) and apply the vendor-recommended firmware update for the DVP80ES3; a specific patched version could not be independently confirmed from the provided data, so verify the exact fixed release in that advisory. Because this is an ICS/PLC device with network attack surface, apply compensating controls per standard OT hardening: place the PLC on an isolated OT network segment behind a firewall and deny the affected management/fieldbus ports from untrusted networks (trade-off: legitimate remote engineering/SCADA access must be explicitly allowed through the firewall), restrict access to only known engineering workstations and SCADA hosts via allow-listing (trade-off: requires accurate asset inventory), and require VPN for any remote access to the OT zone. Given the high availability impact, also ensure the controlled process has fail-safe/monitoring so a device disruption does not create an unsafe physical condition.
Denial of service in Delta Electronics DVP80ES3 programmable logic controllers arises from an improper resource shutdown
Denial of service in Delta Electronics DVP80ES3 programmable logic controllers arises from a failure to enforce message
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today