CVE Intelligence
Analysis AI-assisted

CVE-2026-12818: Delta Electronics DVP12SE PLC Modbus TCP Resource Allocation Without Limits (CWE-770)

Delta Electronics DVP12SE PLCs are susceptible to CWE-770, allocation of resources without limits or throttling, in their Modbus TCP service. The record carries a CVSS 4.0 base score of 9.3 (critical) from the CNA, with a network attack vector and no privileges or user interaction required. The record is not listed in CISA KEV, no confirmed exploitation appears in the sources consulted, and it lists no affected versions or fixes.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Delta Electronics DVP12SE PLCs are susceptible to a resource allocation weakness without limits or throttling (CWE-770) in their Modbus TCP service. The record points to a vendor advisory from Delta Electronics (PCSA-2026-00011) that covers this issue and a second CVE in the same advisory. Details beyond the record's description are not available in the sources consulted.

Impact

The CVSS 4.0 vector in the record indicates high impact on confidentiality, integrity and availability of the vulnerable system (VC:H, VI:H, VA:H), with no impact on subsequent systems. Because CWE-770 concerns resources that are not bounded, the practical consequence is most likely degraded availability of the PLC service, but the exact behavior is inference and is not described in the record.

  • Vector reads as network-reachable, low complexity, no privileges and no user interaction.
  • Base score 9.3 is a CNA-supplied value; no second scoring provider appears in the record.

Affected products and versions

The record lists the product as Delta Electronics DVP12SE PLCs but contains no affected version ranges, no CPE data and no fixed versions. Whether other DVP series models are affected is unknown from the record. Operators should rely on the vendor advisory for version scope and treat the missing data as unknown rather than as unaffected.

Exploitation status

CISA KEV lists this CVE as not listed in the record. No confirmed exploitation appears in the sources consulted. The EPSS estimate in the record is a probability of 0.00428 with a percentile of 0.35284, dated 2026-10-13. EPSS is a statistical model of exploitation likelihood and is not evidence that exploitation has occurred.

Remediation and mitigation

  • Obtain the vendor advisory from Delta Electronics and confirm which DVP12SE firmware or hardware revisions are affected and which updates are available.
  • Apply vendor-provided updates or workarounds as soon as they are validated for your environment; the record does not provide a fix.
  • Restrict access to the Modbus TCP service to known engineering and supervisory hosts, using segmentation and firewall rules that keep PLCs out of general IT and internet-facing networks.
  • Disable Modbus TCP on devices where it is not operationally required, if the vendor confirms this is a supported configuration.
  • Review the NVD entry and the CVE Record for updates.

Detection guidance

  • Monitor Modbus TCP connection counts, session rates and traffic volume to each PLC against an established baseline, and alert on sustained spikes.
  • Log and review connections to PLCs from hosts outside approved engineering stations.
  • Watch for PLC unresponsiveness, restarts or abnormal CPU and memory behavior reported by controllers or monitoring tools.
  • Correlate OT network telemetry with change records to separate authorized maintenance from anomalies.

Limitations of the available information

  • The record has no affected version list, no fixed version list and no product identifiers beyond the model name.
  • The vendor advisory text is not included in the record, so its details are not confirmed here.
  • The CVSS 4.0 score and vector come from the CNA; no other scoring source appears in the record. Environmental and threat metrics are marked as not defined.
  • Exact exploitation prerequisites and technical behavior are unknown from the record.

Frequently asked questions

Is CVE-2026-12818 being actively exploited?

CISA KEV does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. The EPSS value in the record is a statistical likelihood estimate, not proof of exploitation.

Which Delta DVP12SE versions are affected?

The record does not list affected versions or fixed versions. Consult the vendor advisory from Delta Electronics to confirm the scope before drawing conclusions.

What is the first step for asset owners?

Identify DVP12SE devices in your environment, confirm their Modbus TCP exposure, and restrict access to trusted engineering and supervisory hosts while you await vendor guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.