EUVD-2026-40257
GHSA-4mxr-9xw9-9cr4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PLC on Modbus TCP/502
-
DeliveryOpen or flood Modbus connections
-
ExploitExhaust unthrottled device resources
-
ExecutionModbus service stalls or crashes
-
ImpactLoss of process control/availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the DVP12SE's Modbus TCP service (typically TCP port 502) and that the Modbus TCP interface is enabled, which is its standard operating mode; no authentication, credentials, or user interaction are needed (PR:N/UI:N). The primary limiting factor is network exposure: in a properly segmented ICS environment where Modbus/502 is firewalled to authorized SCADA/engineering hosts only, an external attacker cannot reach the service. There is no platform- or configuration-specific gate beyond the Modbus service being active and routable from the attacker's position. |
| Impact | The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects an unauthenticated, low-complexity, network-reachable attack, but its impact metrics (VC:H/VI:H/VA:H) conflict with the underlying weakness: CWE-770 plus the 'Denial Of Service' tag point to an availability-only impact, not high confidentiality and integrity loss - verify the impact scope with the vendor advisory, as the 9.3 rating appears inflated for a resource-exhaustion DoS. No EPSS score, KEV entry, or POC was provided, so there is no signal of active or imminent exploitation; the practical priority is driven by exposure rather than proven weaponization. In OT/ICS contexts, however, availability loss of a control PLC can halt a physical process, so despite the absence of exploitation evidence this should be treated as a real patch-priority issue for any DVP12SE reachable from untrusted networks. |
| Exploit ScenarioDerived | An attacker who can route to the PLC's Modbus TCP port opens or floods connections/requests faster than the device can reclaim resources, exhausting its memory or socket pool until the Modbus service stalls or the controller becomes unresponsive. Because the vector is network-based, unauthenticated, and low-complexity, this can be triggered from a compromised engineering workstation or any device with line-of-sight to the control network, halting the monitored process. No public POC was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 30, 2026
Resource exhaustion in Delta Electronics DVP12SE programmable logic controllers lets remote attackers crash or hang the device by overwhelming its Modbus TCP service, which lacks connection/resource throttling (CWE-770). Any host able to reach the PLC's Modbus TCP port can degrade or deny control of the affected industrial process. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the unauthenticated network attack surface makes it a meaningful availability risk in OT environments.
RemediationAI
Apply the firmware update referenced in Delta advisory Delta-PCSA-2026-00011 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf); the input does not contain an exact fixed version number, so confirm the patched firmware build directly from that advisory before deployment. Until patched, isolate the PLC on a segmented OT network and block TCP/502 (Modbus) from all but explicitly authorized engineering/SCADA hosts using firewall ACLs - note this breaks any unlisted Modbus client and requires an accurate allowlist. As compensating controls, place the device behind a Modbus-aware firewall or data diode, enforce per-source connection-rate limiting on the path to the PLC, and continuously monitor Modbus connection counts so an exhaustion attempt triggers an alert; these reduce reachability but do not fix the underlying unbounded allocation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The DVP12SE is a compact Delta Electronics PLC used for machine and process automation, exposing the Modbus/TCP protocol (typically TCP/502) for register read/write and control operations. The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) weakness in the Modbus TCP service: incoming connections or requests are serviced without bounding the memory, sockets, or processing they consume, so a flood of crafted or repeated requests can exhaust device resources. Modbus has no native authentication or rate limiting, so the service implicitly trusts every peer on the routable network, and the affected component is identified by CPE cpe:2.3:a:deltaww:dvp-12se. The vendor reference (Delta-PCSA-2026-00011) covers CVE-2026-12818 alongside CVE-2026-12819.
Know when Dvp 12Se gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable Modbus service (AV:N/AC:L/PR:N/UI:N); CWE-770 resource exhaustion yields availability-only impact, so C:N/I:N/A:H.
Primary rating from Vendor (Deltaww).
CVSS VectorVendor: Deltaww
DescriptionCVE.org
Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-770) within their Modbus TCP service.
Executive ViewAI
Delta Electronics DVP12SE programmable logic controllers are vulnerable to remote denial-of-service attacks that can crash or hang devices controlling industrial processes, with no vendor patch currently available. This affects production availability and operational continuity for any organization using these PLCs in manufacturing or critical infrastructure, particularly those with network-connected Modbus TCP ports exposed to untrusted segments.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to PLC Modbus TCP ports via firewall rules limiting source IPs to authorized engineering workstations and SCADA systems only; (2) Implement network segmentation isolating PLCs from general corporate networks and internet-facing systems; (3) Deploy connection rate limiting and anomaly detection on Modbus TCP traffic to detect resource exhaustion attempts; (4) Monitor PLC CPU and memory utilization for signs of denial-of-service conditions; (5) Consider air-gapping or DMZ placement of critical PLCs until patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB