Dvp 12Se Firmware
Monthly
Cleartext transmission in Delta DVP-12SE PLC firmware causes sensitive Modbus/TCP traffic - process values, register contents, and control commands - to cross the network unencrypted and unauthenticated, letting an attacker on the same Layer-2 segment eavesdrop on, inject into, or modify communications with the device. The CVSS 4.0 base score of 7.2 is driven by the adjacency requirement (AV:A) and the absence of any authentication or user interaction (PR:N/UI:N), with impact scored as low confidentiality and high integrity/availability loss against the PLC itself; subsequent-system metrics are all None, so the flaw does not chain outward to other assets. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because exploitation demands a foothold on the OT/adjacent network rather than internet reachability, this is a moderate-priority ICS issue rather than an urgent internet-wide emergency.
Cleartext transmission in Delta DVP-12SE PLC firmware causes sensitive Modbus/TCP traffic - process values, register contents, and control commands - to cross the network unencrypted and unauthenticated, letting an attacker on the same Layer-2 segment eavesdrop on, inject into, or modify communications with the device. The CVSS 4.0 base score of 7.2 is driven by the adjacency requirement (AV:A) and the absence of any authentication or user interaction (PR:N/UI:N), with impact scored as low confidentiality and high integrity/availability loss against the PLC itself; subsequent-system metrics are all None, so the flaw does not chain outward to other assets. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because exploitation demands a foothold on the OT/adjacent network rather than internet reachability, this is a moderate-priority ICS issue rather than an urgent internet-wide emergency.