CVE-2026-12819: DVP12SE PLC Auth Bypass Vulnerability

CVE-2026-12819 Overview

CVE-2026-12819 is a missing authentication vulnerability [CWE-306] in the Delta Electronics DVP12SE programmable logic controller (PLC). The device exposes a Modbus TCP service on a network-reachable port without authentication or access control. Any attacker with network reach to the PLC can interact with security-sensitive PLC functions, including reading and writing coils, registers, and control state. The vulnerability affects the confidentiality, integrity, and availability of the industrial control process the PLC governs.

Critical Impact
Unauthenticated network attackers can read PLC memory, modify control logic state, and disrupt operational technology (OT) processes controlled by the DVP12SE.

Affected Products

Delta Electronics DVP12SE PLC (Modbus TCP service)
Refer to the Delta Security Advisory PCSA-2026-00011 for the specific firmware versions listed by the vendor
Deployments exposing the PLC Modbus TCP port to shared, corporate, or internet-reachable networks

Discovery Timeline

2026-06-30 - CVE-2026-12819 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-12819

Vulnerability Analysis

The DVP12SE PLC implements Modbus TCP, a widely used industrial protocol, without any authentication layer in front of it. Modbus TCP itself has no native authentication in the base specification. When a vendor exposes it directly on a device without additional access controls, any client that can complete a TCP handshake to the service port can issue function codes.

An attacker can enumerate the device, read holding and input registers, write to coils and registers, and issue diagnostic function codes. On a PLC, these operations translate directly into changes to physical process control, including altering setpoints, forcing outputs, or halting execution. The classification of Modbus registers as security-sensitive PLC functions places this issue in [CWE-306] Missing Authentication for a Critical Function.

The issue is reachable over the network with low attack complexity and requires no user interaction. The EPSS probability is 0.31%.

Root Cause

The root cause is a design decision to expose Modbus TCP without an authentication or authorization mechanism, and without restricting the service to a management interface or trusted subnet. Any host able to route packets to the PLC on the Modbus port is treated as an authorized operator.

Attack Vector

Exploitation requires only network access to the PLC and a standard Modbus TCP client. An attacker sends Modbus function codes such as Read Holding Registers (0x03), Write Single Register (0x06), or Write Multiple Registers (0x10) to manipulate PLC state. No credentials, session establishment, or privilege escalation is required.

See the Delta Security Advisory PCSA-2026-00011 for vendor-provided technical detail. No verified public proof-of-concept code has been published at the time of writing.

Detection Methods for CVE-2026-12819

Indicators of Compromise

Unexpected Modbus TCP connections to the DVP12SE on the configured Modbus port (default TCP/502) from hosts outside the OT engineering workstation allowlist.
Modbus write function codes (0x05, 0x06, 0x0F, 0x10) originating from IT network segments, remote access gateways, or unknown external IP addresses.
Sudden changes to PLC coil or register values that do not correlate with logged engineering workstation activity.
PLC entering STOP mode or restarting outside of scheduled maintenance windows.

Detection Strategies

Deploy an OT-aware intrusion detection sensor that parses Modbus TCP and alerts on write function codes from non-approved source addresses.
Baseline normal Modbus client-server pairs and flag any new client attempting to reach the PLC.
Correlate PLC event logs and HMI logs with network flow data to identify commands not originating from authorized supervisory systems.

Monitoring Recommendations

Log all TCP connections to port 502 on the PLC subnet and forward to a SIEM for retention and correlation.
Alert on scanning behavior targeting Modbus ports across the OT VLAN, including sequential probes and function code 0x2B (Encapsulated Interface Transport) device identification requests.
Monitor firewall drops at the IT/OT boundary for Modbus traffic, which should never traverse that boundary directly.

How to Mitigate CVE-2026-12819

Immediate Actions Required

Confirm that the DVP12SE Modbus TCP port is not reachable from the internet or from general-purpose IT networks. Block at the perimeter and at the OT boundary firewall.
Restrict the Modbus TCP service to a dedicated engineering VLAN with a strict allowlist of source IP addresses for HMIs, SCADA servers, and engineering workstations.
Review PLC configuration and program integrity to confirm no unauthorized changes have been made.
Apply vendor updates or configuration guidance published in the Delta Security Advisory PCSA-2026-00011.

Patch Information

Delta Electronics has published advisory PCSA-2026-00011 covering CVE-2026-12818 and CVE-2026-12819. Consult the advisory for firmware fixes, configuration hardening steps, and any interim mitigations recommended by the vendor for the DVP12SE product line.

Workarounds

Place the PLC behind an OT firewall or industrial DMZ that enforces source-address and function-code allowlisting for Modbus TCP.
Terminate remote engineering access through a jump host with multi-factor authentication rather than exposing Modbus directly.
Where supported, front the PLC with a Modbus-aware gateway that adds authentication or protocol translation.
Disable the Modbus TCP service on the PLC if it is not required for operations.

bash

# Example: restrict Modbus TCP (port 502) to a specific engineering workstation
# using iptables on an OT gateway/firewall in front of the PLC
iptables -A FORWARD -p tcp --dport 502 -s 10.20.30.40 -d 10.10.10.5 -j ACCEPT
iptables -A FORWARD -p tcp --dport 502 -d 10.10.10.5 -j DROP