DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel…

CVE-2026-12576 is a CWE-924 Improper Enforcement of Message Integrity flaw in the Delta Electronics DVP80ES3 — a compact PLC in the DVP-ES3 series widely deployed on packaging, conveyor, and small-batch manufacturing lines. The protocol channel does not adequately verify message authenticity/integrity, so a network-reachable attacker can inject or tamper with control-plane traffic and drive the controller into a fault or halt state. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) scores only availability impact, but on a PLC 'availability loss' means a physical process stops — press, mixer, conveyor, valve.

Vendor severity of HIGH (7.5) is honest for the impact captured in the vector, but it undersells the *operational* reality. IT-style CVSS treats a crashed daemon as an inconvenience; on a controller sitting between logic and steel, a crash is an unplanned shutdown with cascading downtime, potential scrap, and — depending on the process — safety implications. Reassessed to HIGH (7.8) with the OT context floor in force.

Why this verdict

• Role multiplier — OT/ICS controller: DVP80ES3 is a PLC. The documented chain ends in a stopped physical process. Per the deployment-role floor rule, the affected component is canonically a high-value-role component (ICS controller) and the floor is at minimum HIGH.
• Network attack vector, no auth: AV:N/AC:L/PR:N/UI:N — anyone who can route packets to the device wins. There is no crypto or authentication step to defeat.
• Segmentation friction is real but leaky: most DVP80ES3 units sit behind plant firewalls, which is why we don't push to CRITICAL. But OT segmentation failures via engineering workstations, jump hosts, vendor remote access, and flat networks are the single most common OT-incident root cause — enough to hold at HIGH, not downgrade to MEDIUM.
• Availability-only vector understates OT reality: the CVSS score treats A:H as a DoS. On a PLC, A:H is an unplanned production stop with potential safety, scrap, and regulatory consequences. The 7.5 label is fair on the IT scale; the operational cost is materially higher.

Why not higher?

Not CRITICAL because the CVE does not grant code execution, integrity of process logic, or persistent compromise — it is a denial condition. Additionally, well-segmented OT networks and unidirectional gateways make the network-reachability precondition non-trivial for the majority of installed base.

Why not lower?

Not MEDIUM because a PLC-halting bug with AV:N/PR:N on an unauthenticated protocol channel is exactly the class of flaw that has caused real-world OT incidents. Downgrading a controller DoS to MEDIUM on the assumption 'the network is segmented' is the same reasoning that has failed in every post-incident report from Colonial to Norsk Hydro.

1. Enforce strict ACLs at the OT firewall for DVP80ES3 traffic — Whitelist only the engineering workstations and HMIs that legitimately talk to each PLC — deny by default. Deploy within 30 days per the noisgate HIGH mitigation SLA.
2. Deploy passive OT monitoring signatures for anomalous DVP/Modbus frames — Push Nozomi/Claroty/Dragos rules to alert on unexpected source IPs, unusual function codes, or malformed frames toward DVP80ES3 units. Same 30-day window — most sites already have the sensors, this is a rule push, not a deployment.
3. Audit and lock down engineering workstation dual-homing — Engineering laptops that bridge IT and OT are the single most common bypass of segmentation. Enforce dedicated OT-only workstations or session-brokered access (CyberArk PSM, BeyondTrust, Claroty SRA) within 30 days.
4. Verify safety-PLC / SIL logic drives to a safe state on comms loss — Confirm the process design tolerates an unplanned PLC halt safely. This is a design review, not a patch — but it is what turns a HIGH into a MEDIUM in your specific plant.
5. Schedule the vendor firmware update in the next maintenance window — Delta firmware updates require a controlled outage. Plan the update inside the noisgate 180-day HIGH remediation SLA; do not chase a same-week patch that risks an unplanned outage.

Run this on an auditor workstation or engineering laptop that has network reachability to the target PLC. Invoke as python check_dvp80es3.py 10.20.30.40 (replace with the PLC IP). Requires network reachability only; no credentials. This is a passive banner/identity check — it does NOT send malformed traffic and will not affect the PLC.

#!/usr/bin/env python3
# noisgate DVP80ES3 CVE-2026-12576 exposure check
# Passive reachability + Modbus device-identity probe. Non-invasive.
# Exit codes: 0 PATCHED / not reachable, 1 VULNERABLE / needs review, 2 UNKNOWN

import socket, struct, sys

VULNERABLE_MODELS = ('DVP80ES3',)  # extend once advisory lists exact firmware range
MODBUS_PORT = 502

def modbus_read_device_id(ip, port=MODBUS_PORT, timeout=3):
    # Modbus function 43 / MEI 14 - Read Device Identification
    tx_id = 0x0001
    pdu = struct.pack('>BBBB', 43, 14, 1, 0)  # fn, MEI, ReadDevIdCode=basic, ObjectId=0
    mbap = struct.pack('>HHHB', tx_id, 0, len(pdu)+1, 0xFF)
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(timeout)
        s.connect((ip, port))
        s.send(mbap + pdu)
        data = s.recv(1024)
        s.close()
        return data
    except Exception:
        return None

def main():
    if len(sys.argv) != 2:
        print('usage: check_dvp80es3.py <ip>')
        sys.exit(2)
    ip = sys.argv[1]
    resp = modbus_read_device_id(ip)
    if resp is None:
        print(f'UNKNOWN {ip} - not reachable on tcp/502')
        sys.exit(0)
    try:
        text = resp.decode('latin-1', errors='ignore')
    except Exception:
        text = ''
    for model in VULNERABLE_MODELS:
        if model in text:
            print(f'VULNERABLE {ip} - identifies as {model} (confirm firmware vs Delta PSIRT advisory)')
            sys.exit(1)
    print(f'UNKNOWN {ip} - reachable, model string not matched. banner={text!r}')
    sys.exit(2)

if __name__ == '__main__':
    main()

Sources

1. CISA ICS Advisories index
2. Delta Electronics Product Security
3. CWE-924: Improper Enforcement of Message Integrity
4. Delta Electronics CVE catalog (OpenCVE)
5. CISA ICS advisory: Delta Electronics DTM Soft (reference format)
6. NVD CVE record
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS