External risk intelligence

Delta Electronics DVP12SE PLC Modbus TCP Resource Allocation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-12818

The vulnerability affects a Modbus TCP service on a Programmable Logic Controller (PLC). While the protocol is network-accessible, industrial control devices like PLCs are typically deployed within isolated internal or operational technology (OT) networks and are not intended to be directly exposed to the public internet in common deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a resource allocation vulnerability impacting Delta Electronics DVP12SE PLCs through their Modbus TCP service. This type of vulnerability, often referred to as an unbounded resource allocation, could potentially allow an attacker to consume excessive system resources, leading to performance degradation or denial of service for critical operational technology. The main concern is confirming relevance and exposure within your specific environment.

Uncontrolled resource use in industrial controllers.
Understand potential operational technology impact.
Confirm if your environment is affected.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable Modbus TCP service on Delta Electronics DVP12SE PLCs over the network without needing any credentials or user interaction. By sending specially crafted network traffic to the service, an attacker could trigger a resource allocation vulnerability, potentially leading to a denial-of-service condition.

Network access required.
Triggered by Modbus TCP service.
Risk of denial-of-service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the availability of Delta Electronics DVP12SE PLCs when their Modbus TCP service is accessed. Under conditions supported by the advisory, unlimited resource allocation could lead to a denial of service.

PLC service availability at risk.
Uncontrolled resource allocation.
Device may become unresponsive.

Operational Fix

Recommended remediation, mitigation, and detection steps

Industrial control system owners and operational technology (OT) teams are likely responsible for addressing this vulnerability in Delta Electronics DVP12SE PLCs. The initial practical step involves identifying all deployed instances of the affected PLC, assessing their network reachability, and determining their criticality to operations before planning any remediation activities.

Confirm PLC inventory and network exposure.
Identify business-critical systems running the PLC.
Plan vendor-coordinated remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is a Delta Electronics DVP12SE PLC?

The DVP12SE is a compact programmable logic controller (PLC) used in industrial automation. It acts as a specialized computer that monitors inputs and controls outputs to manage machinery, assembly lines, or other physical processes in manufacturing and infrastructure environments.

What does CVE-2026-12818 mean by resource allocation vulnerability?

This vulnerability, classified as CWE-770, happens when a system fails to set limits on the amount of memory or processing power a service can claim. In this case, the device's Modbus TCP service does not throttle incoming requests, allowing a stream of traffic to exhaust hardware resources and crash the controller.

How is this vulnerability triggered?

An attacker triggers this by sending specifically crafted network traffic to the Modbus TCP service. It does not require user interaction or valid authentication credentials to initiate. Simply performing legitimate-looking management tasks will not trigger the bug unless they are deliberately designed to overwhelm the system's allocation limits.

Is my environment at risk from this PLC vulnerability?

Risk depends on network connectivity. According to Halo Surface Signal, this PLC is typically used in isolated operational technology networks. If your device is not directly reachable from the public internet, the likelihood of remote exploitation is significantly lower than for a device exposed at the network edge.

What should I do if I use these controllers?

Start by identifying all instances of the DVP12SE within your infrastructure to build an accurate inventory. Assess whether these devices are connected to internal networks or exposed externally, and prioritize those critical to your operations for coordination with your security or OT teams to plan remediation steps.

References

filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Mul…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.