CVE-2026-12575: DVP80ES3 DOS Vulnerability

CVE-2026-12575 Overview

CVE-2026-12575 is an Improper Resource Shutdown or Release vulnerability [CWE-404] affecting the Delta Electronics DVP80ES3 programmable logic controller (PLC). The flaw allows a remote, unauthenticated attacker to trigger an availability impact on the device over the network. Successful exploitation does not compromise confidentiality or integrity but can render the controller unresponsive, disrupting industrial processes that depend on the PLC. Delta Electronics documented this issue alongside two related findings (CVE-2026-12576 and CVE-2026-12577) in advisory Delta-PCSA-2026-00009.

Critical Impact
Remote attackers can exhaust or improperly release resources on the DVP80ES3, causing denial of service to the PLC and any operational process it controls.

Affected Products

Delta Electronics DVP80ES3 programmable logic controller
Refer to the Delta Advisory CVE-2026-12575 for the complete list of impacted firmware versions

Discovery Timeline

2026-07-01 - CVE-2026-12575 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-12575

Vulnerability Analysis

The DVP80ES3 fails to properly shut down or release system resources after they are no longer required. Under CWE-404, this class of defect leaves file handles, memory allocations, network sockets, or internal state structures in an unreleased state. Over repeated interactions, the resource pool depletes and the device can no longer service legitimate requests. Because the DVP80ES3 is a PLC deployed in operational technology (OT) environments, an availability failure directly affects the physical processes that the controller drives.

Root Cause

The root cause is improper resource management in the DVP80ES3 firmware. Specific code paths do not invoke the correct cleanup routines when a session, request, or protocol interaction terminates. Repeated triggering of the affected code path leads to resource exhaustion, culminating in denial of service. The vulnerability requires no authentication and no user interaction to reach the affected functionality.

Attack Vector

An attacker with network reachability to the PLC's exposed service can send crafted requests that repeatedly allocate resources without releasing them. Because industrial protocols often run on flat OT networks, any host on the same segment as the DVP80ES3 can initiate the attack. Verified proof-of-concept code is not publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is available. See the Delta Advisory CVE-2026-12575 for technical details.

Detection Methods for CVE-2026-12575

Indicators of Compromise

Unexpected loss of communication with the DVP80ES3 or watchdog resets on the controller
Repeated short-lived or malformed connections to industrial protocol ports exposed by the PLC from unauthorized source addresses
Growth in the number of half-open or unclosed sessions on the PLC's management interface

Detection Strategies

Baseline normal request rates and session counts to the PLC and alert on statistically significant deviations
Inspect industrial protocol traffic with an OT-aware intrusion detection system for malformed or unusually repetitive requests targeting the DVP80ES3
Correlate PLC restart or unreachable events in SCADA and historian logs with network-side connection anomalies

Monitoring Recommendations

Continuously monitor availability of the DVP80ES3 through ICMP, protocol-level health checks, and SCADA polling metrics
Log all inbound connections to PLC ports at the OT firewall and forward the logs to a central SIEM for retention and analysis
Alert on any new source host initiating connections to the PLC outside of the approved engineering workstation allowlist

How to Mitigate CVE-2026-12575

Immediate Actions Required

Apply the firmware update referenced in the Delta Advisory CVE-2026-12575 as soon as a maintenance window allows
Restrict network access to the DVP80ES3 to authorized engineering workstations using firewall rules or ACLs
Segment the PLC into a dedicated OT zone isolated from IT networks and the internet in line with IEC 62443 zone and conduit guidance

Patch Information

Delta Electronics publishes fixed firmware versions and remediation guidance in advisory Delta-PCSA-2026-00009, which also addresses CVE-2026-12576 and CVE-2026-12577. Consult the advisory for the exact firmware build required for the DVP80ES3 in your deployment.

Workarounds

Place the DVP80ES3 behind an industrial firewall that enforces protocol allowlisting and rate limiting on inbound sessions
Disable or block network exposure of any DVP80ES3 service that is not required for operations
Implement out-of-band monitoring so that a resource exhaustion condition can be detected and the device power-cycled to restore service

bash

# Example firewall rule restricting PLC access to a single engineering workstation
iptables -A FORWARD -s 10.10.20.15 -d 10.10.50.10 -p tcp --dport 502 -j ACCEPT
iptables -A FORWARD -d 10.10.50.10 -j DROP