CVE-2026-12819 describes a missing authentication vulnerability in the Delta Electronics DVP-12SE PLC. The device exposes a Modbus TCP service on a specified port that lacks any authentication or access control mechanisms. This allows unauthenticated attackers to access and interact with critical PLC functions, potentially impacting the integrity, availability, and confidentiality of the system. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). No vendor advisory or patch information is currently available, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

An attacker can connect to the Modbus TCP service on the affected DVP-12SE PLC without authentication and perform unauthorized operations on critical PLC functions. This can lead to high impact on confidentiality, integrity, and availability of the industrial control system managed by the PLC. Given the critical CVSS score of 9.3, exploitation could result in significant operational disruption or safety risks in environments using this device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published, users should consider implementing network-level protections such as isolating the PLC from untrusted networks, restricting access to the Modbus TCP port, and monitoring for unauthorized connections. Vendor guidance should be monitored closely for any forthcoming patches or official mitigations.