Multiple critical vulnerabilities were identified in Delta DVP-12SE11T PLCs running firmware prior to v2.16. These flaws exist in the PLC’s Ethernet communication service, which listens continuously for industrial protocol traffic and performs insufficient authentication, weak input validation, and unsafe memory handling.
An attacker with network access only (no credentials) can exploit these weaknesses to:
- Bypass authentication
- Interact directly with PLC logic
- Crash or hang the controller
- Corrupt memory and disrupt physical processes
These vulnerabilities are particularly dangerous because PLCs often operate without endpoint protection, rely on implicit trust, and directly control real-world machinery.
Affected Product
- Vendor: Delta Electronics
- Product Line: Delta DVP Series PLC
- Affected Model: DVP-12SE11T
- Affected Firmware: Versions earlier than 2.16
- Attack Vector: Network (Ethernet)
- Authentication Required: None
- User Interaction: None
The vulnerabilities reside in the PLC’s Ethernet communication service, which continuously listens for industrial protocol traffic used for monitoring, programming, and control operations.
Vulnerability Details
1. Authentication Bypass
CVE-2025-15102
Severity: Critical
CVSS (approx.): 9.1
Attack Complexity: Low
Description
The PLC fails to consistently enforce authentication checks for certain network command handlers. By sending specially crafted Ethernet packets, an attacker can access privileged PLC functionality without completing a valid login process.
Root Cause
Some request paths are processed before session authentication flags are validated. Manipulating specific fields in the packet header causes the PLC to incorrectly treat the request as authenticated.
Impact
- Execution of unauthorized PLC commands
- Ability to read or modify controller state
- Potential manipulation of industrial processes
2. Authentication Weakness and Partial Credential Disclosure
CVE-2025-15103
Severity: Critical
CVSS (approx.): 9.8
Description
The PLC responds differently depending on how much of the supplied password is correct. These subtle response differences leak information about password validation, allowing attackers to infer credential details over repeated requests.
Root Cause
Improper error handling during authentication exposes internal validation logic through observable response behavior.
Impact
- Reduced effort for password guessing
- Enables chaining with authentication bypass vulnerabilities
- Weakens overall access control
Why This Matters
PLCs typically lack strong password policies, rate limiting, or account lockout mechanisms. Even partial credential disclosure significantly lowers the barrier to compromise.
3. Denial-of-Service via Improper Input Validation
CVE-2025-15358
Severity: High
CVSS (approx.): 7.1
Description
The PLC does not adequately validate the size and structure of incoming network packets. Malformed or oversized packets can cause the Ethernet service to crash or hang.
Root Cause
Missing bounds checks and insufficient sanity validation on packet length and data fields.
Impact
- PLC becomes unresponsive
- Production downtime
- Manual reboot required
- Potential safety impact depending on the controlled process
4. Out-of-Bounds Memory Write
CVE-2025-15359
Severity: Critical
CVSS (approx.): 9.1
Description
Certain network requests trigger unsafe memory operations that allow data to be written outside allocated memory buffers, resulting in memory corruption.
Root Cause
Improper bounds checking in memory handling routines within the Ethernet service.
Impact
- PLC instability and unpredictable behavior
- Corruption of control logic or runtime state
- Long-term process integrity issues
Even without fully weaponized remote code execution, memory corruption alone is sufficient to cause serious operational disruption.
Exploitation Characteristics (Educational Context)
No publicly available weaponized exploit has been broadly released. Any proof-of-concept activity should remain strictly lab-based and for defensive research only.
Observed exploitation traits include:
- Direct PLC communication without an authentication handshake
- Abnormal or non-standard packet sizes
- Repeated probing of authentication responses
- PLC crashes, freezes, or reboots shortly after network interaction
Attackers do not require engineering software or ladder-logic upload capabilities. Interaction with the vulnerable Ethernet service alone is enough to cause impact.
Detection Guidance
Network-Level Indicators
Monitor for:
- PLC traffic originating from non-engineering systems
- Requests sent without prior authentication exchange
- Oversized or malformed packets targeting PLC Ethernet ports
- Unusual command frequency or timing
Example detection logic (conceptual):
IF destination == PLC
AND authentication_state == missing
AND command_type IN (write, control, configuration)
THEN alert
IF payload_length > established_baseline
AND destination == PLC
THEN alert
OT Behavioral Indicators
- PLC entering STOP or FAULT mode unexpectedly
- PLC rebooting outside maintenance windows
- Sudden loss of HMI communication
- Logic or configuration changes without logged engineering activity
Asset Exposure Assessment
Identify Delta DVP PLCs that are reachable from:
- Corporate IT networks
- Remote access gateways
- VPNs without strict access controls
If a PLC is reachable from anything other than a tightly controlled OT segment, it should be considered high risk.
Mitigation and Remediation
Firmware Upgrade (Primary Fix)
Delta Electronics has released firmware addressing these vulnerabilities.
Upgrade all affected devices to firmware version 2.16 or later:
🔗 https://www.deltaww.com/en-US/products/Programmable-Logic-Controllers/ALL/
Firmware upgrades should be performed during controlled maintenance windows and verified for integrity.
Compensating Controls
Even after patching:
- Enforce strict network segmentation
- Block PLC access from IT and internet-connected zones
- Allow PLC communication only from authorized engineering workstations and known HMIs
- Disable unused services and ports on the PLC
- Continuously monitor industrial protocol traffic for anomalies
Risk Summary
| Factor | Risk Level |
|---|---|
| Remote exploitation | High |
| Authentication required | None |
| Exploit complexity | Low |
| Operational impact | Severe |
| OT safety implications | High |
Final Notes
These vulnerabilities highlight a recurring issue in industrial environments: implicit trust in control devices. Any PLC that is reachable over the network must be treated as a high-value asset and protected accordingly.
If left unpatched, these flaws present a realistic path to industrial disruption, equipment damage, or safety incidents.
