CVE-2026-12818: DVP-12SE Exposure of Sensitive Information Vulnerability

Synopsis

An unbounded resource allocation vulnerability (CWE-770) affects the Modbus TCP service in Delta Electronics DVP-12SE PLCs. The flaw is reachable over the network with no authentication required, making it exploitable by any host that can reach the device. Successful exploitation allows an attacker to exhaust device resources, corrupt in-flight data, and crash the Modbus TCP service entirely. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the DVP-12SE Modbus TCP service over the network; any host with IP connectivity to the device can attempt the attack.

• AuthenticationNot required

  No credentials or account are needed; the Modbus TCP service accepts unauthenticated connections by design.

• Victim interactionNot required

  No user or operator action is required; the attacker interacts directly with the exposed service.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, special memory layouts, or environmental prerequisites are required.

Blast Radius

• Exhausts memory or connection-table resources on the PLC, rendering the Modbus TCP service unresponsive to legitimate control traffic.
• Crashes the affected DVP-12SE service, disrupting any industrial process or equipment relying on the PLC for real-time control.
• Corrupts or drops in-flight Modbus register reads and writes, causing incorrect values to be committed to connected systems.
• Combines confidentiality, integrity, and availability impact against the vulnerable component, giving an attacker full loss of sensor data, writable coil state, and device uptime.