Which versions of Delta DVP12SE are affected by CVE-2026-12819?

Delta Electronics DVP12SE programmable logic controllers are vulnerable to unauthenticated remote network access enabling attackers to directly read and modify critical automation functions without…

How to fix or mitigate CVE-2026-12819?

Within 24 hours: Conduct urgent inventory of all Delta DVP12SE controllers and determine network exposure (internet connectivity, remote access points, DMZ placement). Within 7 days: Implement mandatory network segmentation using firewalls to restrict Modbus TCP port 502 access to DVP12SE devices-allow connections only from authenticated engineering workstations and required automation networks; enable detailed logging of all Modbus protocol activity. Within 30 days: Continuously monitor Delta Electronics PCSA advisories and security bulletins for patch release; evaluate long-term remediation strategies including device replacement with patched firmware versions, protocol upgrades, or architectural redesign to eliminate direct network access.

Delta DVP12SE CVE-2026-12819

Q: What is the CVSS score of CVE-2026-12819?

CVE-2026-12819 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40258 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-30 Deltaww

GHSA-xpw2-pg2w-j67h

Authentication Bypass Dvp 12Se Deltaww

9.3

CVSS 4.0 · Vendor: Deltaww

Severity by source

Vendor (Deltaww) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, low-complexity, unauthenticated Modbus access (AV:N/AC:L/PR:N/UI:N) grants full read/write control of the PLC, giving high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Deltaww).

CVSS VectorVendor: Deltaww

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 07:32 vuln.today

DescriptionCVE.org

Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access control, permitting unauthenticated interaction with security-sensitive PLC functions.

AnalysisAI

Unauthenticated Modbus TCP exposure on the Delta Electronics DVP12SE programmable logic controller lets any network-reachable attacker invoke security-sensitive PLC functions - reading and writing process registers, coils, and configuration - with no credentials or access control. The flaw (CWE-306, Missing Authentication for a Critical Function) carries a CVSS 4.0 base of 9.3 and is documented in Delta advisory PCSA-2026-00011 alongside CVE-2026-12818. There is no public exploit identified at time of analysis and no CISA KEV listing, but the Modbus protocol is trivially scriptable and well understood, lowering the practical exploitation bar.

Technical ContextAI

The DVP12SE is a compact PLC in Delta's DVP-SE series used to control physical processes and I/O in automation environments. It serves Modbus/TCP - an OT protocol that, by design, has no built-in authentication, integrity, or encryption - on a configurable TCP port (the Modbus default is 502). CWE-306 captures the root cause: a security-critical function (control of PLC logic, register, and coil state) is reachable without any authentication step. The affected product is identified by CPE cpe:2.3:a:deltaww:dvp-12se:*:*:*:*:*:*:*:*. Because Modbus function codes for reading/writing registers and coils are standardized and openly documented, an attacker needs only TCP reachability to the listening port to issue valid commands.

RemediationAI

Patch available per vendor advisory - review Delta PCSA-2026-00011 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf) for the corrective firmware version, as no exact fix version was included in the supplied data and should not be assumed. Because Modbus/TCP cannot itself enforce authentication, the primary compensating control is network isolation: place the PLC on a segmented OT VLAN with no routable path from IT or the internet, and block inbound access to the Modbus port (default 502, or the configured port) at the firewall, allowing only an explicit allowlist of engineering workstations and SCADA hosts - the trade-off is that any legitimate remote tooling must be added to that allowlist. Where remote engineering access is required, front it with an authenticated VPN or OT-aware jump host and a Modbus-aware firewall/data diode that restricts permitted function codes to read-only where write access is not needed (this can break HMIs that issue writes). Continuously monitor for unexpected write commands to PLC registers/coils as a detective control.