Dvp 12Se11T Firmware
Monthly
An out-of-bounds memory write in the firmware of the Delta DVP-12SE11T programmable logic controller allows remote attackers to corrupt memory on a network-reachable device, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating no authentication or user interaction is required and full loss of confidentiality, integrity, and availability. The flaw is classified as CWE-787 (out-of-bounds write) and is reported against the DVP-12SE11T firmware with no version constraint in the CPE record, meaning all observed firmware builds of that model should be treated as affected until the vendor advisory (Delta PCSA-2025-00022) narrows the range. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; realistic exploitation depends on an attacker first reaching the controller on an OT/plant network segment, since the exact triggering protocol, port, or message type is not disclosed in the available data.
Denial of service in Delta Electronics DVP-12SE11T PLC firmware lets an unauthenticated, remote attacker crash or otherwise render the device unavailable (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The vulnerability stems from improper input validation (CWE-20) in the device's exposed network service, and the CPE entry cpe:2.3:o:deltaww:dvp-12se11t_firmware:* indicates all observed firmware versions are affected. Risk is moderate rather than critical: EPSS is 0.32% (23rd percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and the practical barrier is network reachability - the device is normally deployed inside segmented or air-gapped OT networks, where no authentication or user interaction is required once the attacker can reach the service.
Authentication bypass in Delta DVP-12SE11T PLC firmware allows unauthenticated remote attackers to fully compromise the device via partial password disclosure. The vulnerability is network-reachable, requires no credentials or user interaction, and can lead to complete loss of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Delta DVP-12SE11T PLCs allows remote, unauthenticated attackers to fully compromise the controller’s confidentiality, integrity, and availability (CVSS 9.8). The flaw (CWE-288) leverages an alternate authentication path in the firmware, requiring network access to the device's engineering or communication interface and no user interaction. No public exploit identified at time of analysis; exploitation is primarily limited by OT network segmentation and firewalling.
An out-of-bounds memory write in the firmware of the Delta DVP-12SE11T programmable logic controller allows remote attackers to corrupt memory on a network-reachable device, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating no authentication or user interaction is required and full loss of confidentiality, integrity, and availability. The flaw is classified as CWE-787 (out-of-bounds write) and is reported against the DVP-12SE11T firmware with no version constraint in the CPE record, meaning all observed firmware builds of that model should be treated as affected until the vendor advisory (Delta PCSA-2025-00022) narrows the range. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; realistic exploitation depends on an attacker first reaching the controller on an OT/plant network segment, since the exact triggering protocol, port, or message type is not disclosed in the available data.
Denial of service in Delta Electronics DVP-12SE11T PLC firmware lets an unauthenticated, remote attacker crash or otherwise render the device unavailable (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The vulnerability stems from improper input validation (CWE-20) in the device's exposed network service, and the CPE entry cpe:2.3:o:deltaww:dvp-12se11t_firmware:* indicates all observed firmware versions are affected. Risk is moderate rather than critical: EPSS is 0.32% (23rd percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and the practical barrier is network reachability - the device is normally deployed inside segmented or air-gapped OT networks, where no authentication or user interaction is required once the attacker can reach the service.
Authentication bypass in Delta DVP-12SE11T PLC firmware allows unauthenticated remote attackers to fully compromise the device via partial password disclosure. The vulnerability is network-reachable, requires no credentials or user interaction, and can lead to complete loss of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in Delta DVP-12SE11T PLCs allows remote, unauthenticated attackers to fully compromise the controller’s confidentiality, integrity, and availability (CVSS 9.8). The flaw (CWE-288) leverages an alternate authentication path in the firmware, requiring network access to the device's engineering or communication interface and no user interaction. No public exploit identified at time of analysis; exploitation is primarily limited by OT network segmentation and firewalling.