# CVE-2026-12819: Delta Electronics DVP12SE PLC missing authentication in Modbus TCP service

Source: https://junglewise.ai/threats/cve-2026-12819-delta-electronics-dvp12se-plc-missing-authentication-in-modbus  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-12819 · Severity: info · CVSS 9.3 · Published 2026-06-30

Delta Electronics DVP12SE programmable logic controllers (PLCs), which are used to automate industrial machinery and processes, contain a security flaw where a management service is left open without a password. An attacker could remotely connect to these controllers to change settings or disrupt industrial operations. This could lead to unauthorized control of physical equipment, production downtime, or safety risks in a factory environment.

Vendors: [Delta Electronics](https://junglewise.ai/threats/vendors/delta-electronics).

## Quick answers

**Is CVE-2026-12819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12819 being exploited in the wild.

**How severe is CVE-2026-12819?** Informational severity, with a CVSS score of 9.3, published 30 June 2026.

**Which products and versions are affected?** Delta Electronics DVP-12SE PLC All versions.

**Is there a fix for CVE-2026-12819?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12819 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-12819?** Check whether you run Delta Electronics DVP-12SE PLC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Delta Electronics DVP12SE PLC suffers from a missing authentication vulnerability (CWE-306) in its Modbus TCP service implementation. The device exposes a specific port that allows network-based attackers to interact with security-sensitive PLC functions without providing credentials or passing through access control mechanisms. By sending crafted Modbus TCP packets, an unauthenticated attacker can read or write to PLC registers, potentially leading to unauthorized configuration changes, process disruption, or full control over the logic execution. The vulnerability is reachable over the network and requires no user interaction.

## Affected products

- Delta Electronics DVP-12SE PLC All versions

## Timeline

- 2026-06-30: disclosed
- 2026-06-30: advisory

## References

- [https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf](https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf)