CVE-2026-12818 Overview
CVE-2026-12818 affects Delta Electronics DVP12SE programmable logic controllers (PLCs). The device's Modbus TCP service allocates resources without enforcing limits or throttling, classified as [CWE-770]. An unauthenticated attacker on the network can send crafted Modbus TCP traffic to exhaust device resources. Successful exploitation disrupts industrial control processes that rely on the PLC.
The vulnerability carries a CVSS 4.0 base score of 9.3. Delta Electronics published a coordinated advisory covering CVE-2026-12818 alongside CVE-2026-12819. No public exploit code has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
Unauthenticated network attackers can exhaust Modbus TCP resources on Delta DVP12SE PLCs, disrupting industrial control operations.
Affected Products
- Delta Electronics DVP12SE PLC series
- Devices exposing the Modbus TCP service on TCP/502
- Industrial control environments integrating DVP12SE controllers
Discovery Timeline
- 2026-06-30 - CVE-2026-12818 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-12818
Vulnerability Analysis
The DVP12SE Modbus TCP service accepts client connections and processes protocol data units without applying quotas, rate limits, or throttling. Each new connection or request consumes memory, socket handles, and processing time on the controller. Because the device does not cap concurrent sessions or reclaim resources aggressively, sustained traffic drives the PLC toward resource exhaustion.
Modbus TCP was designed for trusted operational technology (OT) networks, and DVP12SE firmware inherits that trust model. The service exposes function codes over TCP/502 without authentication. A client that opens many sockets, holds them open, or streams valid framed requests can consume all available slots. Legitimate engineering workstations and SCADA polling then fail to reach the controller.
Root Cause
The root cause is missing resource governance in the Modbus TCP handler. There is no upper bound on concurrent connections per source, no idle timeout enforcement suitable for hostile input, and no queue management. This aligns with CWE-770, Allocation of Resources Without Limits or Throttling.
Attack Vector
The attack vector is network-based with no privileges and no user interaction required. An attacker with reachability to TCP/502 on the PLC issues repeated connection attempts or protocol requests. The controller can become unresponsive to legitimate Modbus polling, and dependent processes may halt or enter fail-safe states. Refer to the Delta Security Advisory PCSA-2026-00011 for vendor-specific technical details.
Detection Methods for CVE-2026-12818
Indicators of Compromise
- Sudden loss of Modbus TCP responsiveness from DVP12SE controllers during production
- High counts of concurrent TCP sessions to port 502 from a single or small set of source addresses
- SCADA and HMI polling timeouts, watchdog trips, or communication faults referencing the PLC
- Controller diagnostic counters showing exhausted connection slots or dropped requests
Detection Strategies
- Baseline normal Modbus TCP session counts per engineering workstation and alert on deviations
- Inspect network flows to TCP/502 for abnormal connection rates, half-open sockets, or non-approved source IPs
- Correlate PLC unavailability events with concurrent spikes in TCP SYN or Modbus request volume
Monitoring Recommendations
- Deploy passive OT network monitoring capable of parsing Modbus TCP framing and function codes
- Forward firewall and switch telemetry from the OT zone to a SIEM for cross-correlation with PLC health checks
- Monitor engineering workstation logs for repeated Modbus timeout errors that may indicate an ongoing exhaustion attempt
How to Mitigate CVE-2026-12818
Immediate Actions Required
- Apply the firmware update referenced in Delta advisory PCSA-2026-00011 as soon as it is available for your DVP12SE model
- Restrict TCP/502 access to a strict allow-list of engineering workstations and SCADA servers using firewall rules
- Place DVP12SE controllers behind a segmented OT network with no direct exposure to enterprise or internet networks
- Disable Modbus TCP on controllers where it is not operationally required
Patch Information
Delta Electronics has issued security advisory PCSA-2026-00011 covering CVE-2026-12818 and CVE-2026-12819. Refer to the Delta Security Advisory for firmware versions and remediation steps published by the vendor.
Workarounds
- Enforce network segmentation between IT and OT zones per ISA/IEC 62443 recommendations
- Terminate Modbus TCP inside an OT firewall or data diode that rate-limits sessions to the PLC
- Use a Modbus-aware gateway to broker requests and drop excessive concurrent connections
- Establish out-of-band operator procedures to detect and respond to PLC communication loss
# Example firewall allow-list restricting Modbus TCP to authorized hosts
iptables -A INPUT -p tcp --dport 502 -s 10.10.20.15 -j ACCEPT
iptables -A INPUT -p tcp --dport 502 -s 10.10.20.16 -j ACCEPT
iptables -A INPUT -p tcp --dport 502 -m connlimit --connlimit-above 4 -j DROP
iptables -A INPUT -p tcp --dport 502 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
