CVE-2026-12819: DVP-12SE Missing Authentication and Unauthorized Write access Vulnerability

Synopsis

This is a missing authentication vulnerability in the Delta Electronics DVP-12SE programmable logic controller (PLC). The device exposes a Modbus TCP service over the network with no authentication or access control, meaning any network-reachable host can issue commands directly to security-sensitive PLC functions without credentials. Successful exploitation gives an attacker full read access to process data, the ability to write arbitrary values to PLC outputs and registers, and the ability to disrupt or halt physical operations controlled by the device. HarborGuard is tracking the upstream advisory for patch availability and will make a patched-image rebuild available the moment a fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Modbus TCP service is exposed over the network, so an attacker must be able to reach the device's port from a network-connected host.

• AuthenticationNot required

  The service has no authentication or access control, so no credentials of any privilege level are needed to interact with PLC functions.

• Victim interactionNot required

  Exploitation is entirely attacker-driven; no action from an operator or user of the device is required.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, memory layout knowledge, or other environmental factors to succeed.

Blast Radius

• Reads live process data and internal register values from the PLC, exposing operational state and sensor readings.
• Writes arbitrary values to PLC outputs and memory registers, directly manipulating connected physical equipment or processes.
• Halts or disrupts PLC execution, causing loss of control over whatever physical process the device manages.
• Provides a foothold to map and potentially pivot to other devices on the same industrial control network.