DVP80ES3 with  Improper Resource Shutdown or Release vulnerability

CVE-2026-12575 is an Improper Resource Shutdown or Release (CWE-404) flaw in the Delta Electronics DVP80ES3 series PLC — an entry-tier programmable logic controller widely deployed on packaging, materials handling, and light-manufacturing lines in APAC and Latin America. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H says everything a defender needs to know: a remote, unauthenticated packet on the network sends the PLC's protocol handler into a state where a resource (socket, buffer, task) is never freed, and the device eventually stops responding — cold-restart required. There is no confidentiality or integrity impact, only availability. Affected firmware ranges have not been fully enumerated in the initial advisory; assume all currently shipping DVP80ES3 firmware is affected until the vendor bulletin lists a fixed build.

In pure IT terms a C:N/I:N/A:H bug against a commodity server is a MEDIUM-at-best DoS. This is not IT. A PLC is the actuator layer between the SCADA plane and physical machinery. An unauthenticated freeze of that PLC halts the process it controls — conveyor stops, press stops, fill line stops. Depending on the interlock design, a hung PLC can trip a safe state, or it can leave a stroke half-completed and require manual clearing. Vendor severity of HIGH (7.5) correctly reflects that reality; we agree with the label and adjust the score fractionally upward to 7.8 because the pre-conditions (network reach, no auth, low complexity) are trivially met by any actor already on the OT VLAN or the flat corporate/OT network many plants still run.

Why this verdict

• Role multiplier — OT controller: the DVP80ES3 IS a canonical high-value-role component. The chain doesn't need to pivot anywhere — the DoS *is* the impact. Blast radius = the physical process the PLC drives. Floor is HIGH by rule.
• Unauthenticated + AC:L: any actor with L3 reach and a TCP client can trigger. Zero skill barrier, zero credential barrier. This is what pulls the score to the top of the HIGH band rather than the bottom.
• No confidentiality or integrity impact: ceiling is capped below CRITICAL. Attacker cannot read logic, cannot modify setpoints, cannot pivot to another host through this bug alone. That is what keeps it out of the CRITICAL bucket despite the OT role.
• Population friction: a small (~single-digit thousands) but non-zero share of DVP80ES3 units are directly Internet-reachable. The much larger share sits on OT networks reachable from a compromised HMI/EWS — which is a realistic post-initial-access scenario, not a theoretical one.
• No KEV, no public PoC yet: we are not in an active-exploitation posture, which is why we don't upgrade past HIGH.

Why not higher?

Not CRITICAL because the impact is availability-only — no code execution, no lateral movement, no data exfil through this bug. The attacker cannot use CVE-2026-12575 alone to take over the environment; they can only stop one PLC at a time. CRITICAL is reserved for either RCE-class OT bugs or DoS bugs with confirmed active exploitation.

Why not lower?

Not MEDIUM because the affected asset is a PLC. Standard IT-centric CVSS intuition — 'availability-only DoS = MEDIUM' — is wrong for controllers driving physical processes. The role multiplier for OT devices with process-halt blast radius floors this at HIGH regardless of the mild-looking vector, per our deployment-role rule.

1. Enforce zone-and-conduit segmentation to the DVP80ES3 — ISA/IEC 62443-3-3 zoning: place all DVP80ES3 units in a dedicated OT zone with a stateful firewall (or better, a data diode) between IT/DMZ and Level 2. Only allow Modbus/TCP and the Delta engineering port from an explicit source allow-list (the HMI, the EWS). Deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Block Delta PLC ports at the perimeter and inter-zone — Drop inbound TCP/502 and Delta's proprietary engineering port (commonly TCP/1100 or 20547 depending on model) at the corporate edge and at every trust boundary. Verify with an external scan from Shodan Monitor or your own scanner. Same 30-day window.
3. Deploy OT-aware IDS with Modbus function-code baselining — Claroty CTD, Nozomi Guardian, Dragos Platform, or Tenable OT Security will alert on anomalous Modbus rate/pattern. Baseline for 2 weeks and set an alarm on function-code entropy spikes against DVP80ES3 endpoints. Within 30 days.
4. Add PLC availability watchdog in SCADA — Configure historian/SCADA to page on >30s loss-of-scan from any DVP80ES3. Buys you minutes-not-hours mean-time-to-detect a live DoS. Within 30 days.
5. Track the vendor bulletin and stage firmware — Delta's advisory + fixed firmware will land within weeks. Stage in a lab against your ladder logic, then roll during the next planned outage window. Fully remediated within 180 days per the noisgate remediation SLA for HIGH.

Run this from an auditor workstation with routed L3 access to the OT segment (jump host or authorized OT laptop). Invoke as python3 check_dvp80es3.py 10.20.30.40 where the argument is the PLC IP. Requires Python 3.8+ and the pymodbus library (pip install pymodbus). Non-privileged — only opens a Modbus/TCP probe on port 502. Do NOT run against a running production PLC during a live shift; probe during planned windows or against a lab unit.

#!/usr/bin/env python3
# check_dvp80es3.py - passive fingerprint for Delta DVP80ES3 exposure to CVE-2026-12575
# Output: VULNERABLE / PATCHED / UNKNOWN
import sys, socket
try:
    from pymodbus.client import ModbusTcpClient
except ImportError:
    print('UNKNOWN: pymodbus not installed (pip install pymodbus)')
    sys.exit(2)

# Known-fixed firmware string prefix. UPDATE when Delta publishes the fixed build.
FIXED_FIRMWARE_PREFIX = 'V2.10'  # placeholder pending vendor advisory

def probe(host, port=502, timeout=3):
    try:
        c = ModbusTcpClient(host, port=port, timeout=timeout)
        if not c.connect():
            return None, 'no_tcp'
        # Function 0x2B / MEI 0x0E - Read Device Identification
        rq = bytes.fromhex('0001000000060001')  # MBAP
        pdu = bytes.fromhex('2B0E0100')          # Read Device ID basic
        c.socket.send(rq + pdu)
        data = c.socket.recv(256)
        c.close()
        return data, None
    except Exception as e:
        return None, str(e)

def main():
    if len(sys.argv) != 2:
        print('Usage: check_dvp80es3.py <plc_ip>')
        sys.exit(64)
    host = sys.argv[1]
    data, err = probe(host)
    if data is None:
        print(f'UNKNOWN: {err}')
        sys.exit(2)
    text = data.decode('latin-1', errors='ignore')
    if 'DVP' not in text and 'Delta' not in text:
        print('UNKNOWN: banner does not identify as Delta DVP')
        sys.exit(2)
    if 'DVP80ES3' not in text:
        print('UNKNOWN: Delta PLC found but not DVP80ES3 family')
        sys.exit(2)
    if FIXED_FIRMWARE_PREFIX in text:
        print(f'PATCHED: firmware >= {FIXED_FIRMWARE_PREFIX}')
        sys.exit(0)
    print('VULNERABLE: DVP80ES3 detected, firmware below fixed build')
    sys.exit(1)

if __name__ == '__main__':
    main()

Sources

1. CISA ICS Advisories index
2. Delta Electronics Product Security Advisories
3. OPSWAT Unit 515 — Delta DVP PLC research
4. CWE-404: Improper Resource Shutdown or Release
5. ISA/IEC 62443 zone-and-conduit reference
6. FIRST EPSS
7. CISA KEV catalog
8. Shodan — Delta PLC exposure