Which versions of Delta DVP12SE are affected by CVE-2026-12818?

Delta Electronics DVP12SE programmable logic controllers are vulnerable to remote denial-of-service attacks that can crash or hang devices controlling industrial processes, with no vendor patch…

How to fix or mitigate CVE-2026-12818?

Within 24 hours: Inventory all DVP12SE devices and map network connectivity, particularly identifying which devices have Modbus TCP port 502 accessible from untrusted networks. Within 7 days: Implement network segmentation and firewall rules to restrict unauthenticated access to Modbus TCP ports on affected devices; deploy connection rate limiting on network perimeter if possible. Within 30 days: Establish continuous monitoring for Modbus TCP anomalies on affected devices, consult Delta Electronics for patch timeline, and begin evaluation of compensating control effectiveness.

Delta DVP12SE CVE-2026-12818

Q: What is the CVSS score of CVE-2026-12818?

CVE-2026-12818 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40257 CRITICAL

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-30 Deltaww

GHSA-4mxr-9xw9-9cr4

Denial Of Service Dvp 12Se Deltaww

9.3

CVSS 4.0 · Vendor: Deltaww

Severity by source

Vendor (Deltaww) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable Modbus service (AV:N/AC:L/PR:N/UI:N); CWE-770 resource exhaustion yields availability-only impact, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Deltaww).

CVSS VectorVendor: Deltaww

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 07:31 vuln.today

DescriptionCVE.org

Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service.

AnalysisAI

Resource exhaustion in Delta Electronics DVP12SE programmable logic controllers lets remote attackers crash or hang the device by overwhelming its Modbus TCP service, which lacks connection/resource throttling (CWE-770). Any host able to reach the PLC's Modbus TCP port can degrade or deny control of the affected industrial process. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated network attack surface makes it a meaningful availability risk in OT environments.

Technical ContextAI

The DVP12SE is a compact Delta Electronics PLC used for machine and process automation, exposing the Modbus/TCP protocol (typically TCP/502) for register read/write and control operations. The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) weakness in the Modbus TCP service: incoming connections or requests are serviced without bounding the memory, sockets, or processing they consume, so a flood of crafted or repeated requests can exhaust device resources. Modbus has no native authentication or rate limiting, so the service implicitly trusts every peer on the routable network, and the affected component is identified by CPE cpe:2.3:a:deltaww:dvp-12se. The vendor reference (Delta-PCSA-2026-00011) covers CVE-2026-12818 alongside CVE-2026-12819.

RemediationAI

Apply the firmware update referenced in Delta advisory Delta-PCSA-2026-00011 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf); the input does not contain an exact fixed version number, so confirm the patched firmware build directly from that advisory before deployment. Until patched, isolate the PLC on a segmented OT network and block TCP/502 (Modbus) from all but explicitly authorized engineering/SCADA hosts using firewall ACLs - note this breaks any unlisted Modbus client and requires an accurate allowlist. As compensating controls, place the device behind a Modbus-aware firewall or data diode, enforce per-source connection-rate limiting on the path to the PLC, and continuously monitor Modbus connection counts so an exhaustion attempt triggers an alert; these reduce reachability but do not fix the underlying unbounded allocation.