Delta DVP12SE EUVD-2026-40258

The sole prerequisite is network TCP reachability to the DVP12SE's Modbus/TCP service on its configured port (Modbus default 502); per the CVSS vector PR:N/UI:N there is no authentication and no user interaction required, and exploitation works against the device's default unauthenticated Modbus interface. The limiting factor is exposure rather than configuration: the PLC must be reachable from the attacker's network position, so deployments with strict OT segmentation, firewalling, or air-gapping that prevent reaching the Modbus port are not practically exploitable even though the device itself remains unauthenticated.

Signals are largely consistent and point to genuine high priority where the device is network-exposed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact to the vulnerable system (VC:H/VI:H/VA:H) and no scope change to subsequent systems (SC/SI/SA:N), yielding 9.3. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation - absence of KEV/EPSS data here is a gap, not a confirmation of low risk. No public PoC was identified, but Modbus interaction requires only commodity tooling, so the lack of a packaged exploit is weak mitigation. The dominant real-world risk modifier is exposure: PLCs are intended to sit on isolated OT networks, so true internet/enterprise reachability - not the CVSS number alone - determines whether this is exploitable in a given deployment.

An attacker who can reach the DVP12SE's Modbus/TCP port - for example via a flat OT network, a compromised engineering workstation, or an internet-exposed device - connects with a standard Modbus client and issues write commands to PLC registers and coils without supplying any credentials. With AV:N/AC:L/PR:N, this requires only TCP connectivity and openly documented Modbus function codes, allowing the attacker to read process state or alter outputs and disrupt the controlled physical process. No public exploit is identified at time of analysis, but commodity Modbus libraries make weaponization trivial.