What is the CVSS score of CVE-2026-14193?

CVE-2026-14193 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Delta DVP80ES300T are affected by CVE-2026-14193?

Delta Electronics DVP80ES300T programmable logic controllers can be remotely disabled through a denial-of-service vulnerability that halts device operation. No vendor patch is currently available.

How to fix or mitigate CVE-2026-14193?

Within 24 hours: Identify and document all Delta DVP80ES300T devices in your environment and their criticality to production processes. Within 7 days: Implement network segmentation and firewall rules to restrict remote access to affected PLCs. Within 30 days: Monitor Delta Electronics security advisories for patch availability; develop a device replacement or firmware upgrade strategy if remediation extends beyond 90 days.

Delta DVP80ES300T CVE-2026-14193

EUVD-2026-40911 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-01 Deltaww

GHSA-255r-96jc-w7r6

Information Disclosure Dvp80Es300T Deltaww

7.5

CVSS 3.1 · Vendor: Deltaww

Severity by source

Vendor (Deltaww) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity request triggers an out-of-bounds index causing device crash, so AV:N/AC:L/PR:N with availability-only A:H and no C/I impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Deltaww).

CVSS VectorVendor: Deltaww

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 07:15 vuln.today

DescriptionCVE.org

DVP80ES300T with Improper Validation of Array Index Vulnerability

AnalysisAI

Denial-of-service in the Delta Electronics DVP80ES300T programmable logic controller allows remote unauthenticated attackers to crash the device by triggering an improper array-index validation flaw (CWE-129). Per the CVSS vector the impact is limited to availability (A:H) with no confidentiality or integrity loss, so a successful attack halts PLC operation rather than exposing data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided.

Technical ContextAI

The DVP80ES300T is an 80-point unit in Delta's DVP-ES3 series of compact PLCs used for industrial and machine automation. CPE cpe:2.3:a:deltaww:dvp80es300t confirms the single affected product. The root cause is CWE-129 (Improper Validation of Array Index): the device firmware uses an externally influenced value to index into an array without verifying that the value falls within the array bounds, allowing an out-of-bounds access. In embedded/PLC firmware such out-of-bounds reads or writes typically corrupt memory or dereference invalid addresses, producing a fault or watchdog reset that stops the control program - consistent with the availability-only CVSS impact.

RemediationAI

Consult Delta advisory Delta-PCSA-2026-00013 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00013_DVP80ES300T%20Improper%20Validation%20of%20Array%20Index%20Vulnerability%20(CVE-2026-14193).pdf) and apply the vendor-provided firmware update; a specific fixed version is not present in the available data and must be taken from that advisory rather than assumed. Because no fixed version is confirmed here, treat network isolation as the primary compensating control: place the PLC on a dedicated OT/control VLAN, block its engineering/communication ports (e.g., Modbus TCP 502 and Delta's programming protocol) from IT and internet-facing segments at the firewall, and permit access only from a hardened engineering workstation or jump host - the trade-off is that legitimate remote SCADA/engineering connectivity must be explicitly whitelisted, which adds configuration overhead. Where continuous availability is safety-critical, pair segmentation with monitoring/alerting on unexpected PLC resets so an attempted DoS is detected quickly.