External risk intelligence

DVP-12SE11T Authentication Bypass via Partial Password Disclosure

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-15103

The affected product is a Programmable Logic Controller (PLC) used in industrial control systems. While these devices are typically deployed within isolated internal operational technology networks, they are occasionally exposed to the internet via port forwarding or misconfiguration, making remote reachability possible but not the standard or intended deployment pattern.

Information Disclosure

Deltaww Dvp 12se11t Firmware

before 2.16

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Delta's DVP-12SE11T devices that could allow unauthorized access and control. The issue involves an authentication bypass mechanism, meaning attackers could potentially gain access without proper credentials, posing a risk to the operational integrity of systems utilizing this technology. The main concern is confirming relevance and exposure.

Bypass authentication to gain unauthorized access.
Critical access flaw in industrial control devices.
Verify if these industrial devices are in use.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by exploiting a partial password disclosure vulnerability in the DVP-12SE11T. This allows them to gain unauthorized access to the device's system. Once authenticated, the attacker can then potentially manipulate system settings or execute arbitrary code.

No privileges needed for initial access.
Authentication bypass via partial password disclosure.
Complete system compromise is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication when supported by the advisory. This could potentially lead to unauthorized access and control over the affected system, impacting its operational integrity.

System authentication controls.
Unauthenticated network access.
Unauthorized system access and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical authentication bypass vulnerability in Delta-Products DVP-12SE11T devices likely falls under the responsibility of the Industrial Control System (ICS) or Operational Technology (OT) asset owners, supported by infrastructure and security teams. The first practical step is to identify all DVP-12SE11T devices within the environment, determine their network exposure and business criticality, and then confirm the accountable owner to plan remediation, potentially involving vendor coordination.

ICS/OT asset owners should lead remediation.
Verify device network exposure and criticality.
Plan coordinated remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Delta DVP-12SE11T?

The DVP-12SE11T is a Programmable Logic Controller (PLC) designed by Delta Electronics. It acts as a specialized industrial computer used to automate manufacturing processes, manage machinery, and oversee operations within industrial control systems (ICS). Because these devices bridge digital commands with physical equipment, they are foundational components in factory and infrastructure environments.

What does authentication bypass mean for CVE-2025-15103?

This vulnerability involves an information exposure weakness, classified as CWE-200. It allows an attacker to gain system access without providing valid credentials by exploiting a flaw that reveals parts of the password. Essentially, the security gate that should block unauthorized users is effectively bypassed, granting the attacker the same control levels as an authenticated administrator.

How is the authentication bypass triggered in this device?

An attacker initiates this by interacting with the device over the network without needing any prior credentials. It is important to note that this flaw specifically targets the device's authentication handshake process. Simply having a connection to the device is enough for an attacker; however, legitimate administrative tasks that do not involve the vulnerable authentication flow do not trigger this specific bypass mechanism.

Do I need to worry if my DVP-12SE11T is internal?

According to Halo Surface Signal, these PLCs are typically deployed within isolated internal operational technology (OT) networks, which helps limit direct reachability. However, you should still be concerned if the device is internet-facing due to port forwarding or common network misconfigurations. If the device can be reached from outside your secure environment, the risk of unauthorized access significantly increases.

When should I start addressing CVE-2025-15103?

You should begin by locating all DVP-12SE11T units in your infrastructure to gauge their operational importance. Once identified, evaluate their network exposure to determine if they are reachable from untrusted zones. Coordinate with your OT and security teams to establish a plan for applying vendor-provided firmware updates, ensuring that remediation is handled carefully to maintain the safety and stability of your industrial processes.

References

filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00022_DVP-12SE11T%2…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.