CVE-2026-12819 describes a missing authentication vulnerability (CWE-306) in the Delta Electronics DVP-12SE PLC. The device exposes a Modbus TCP service on a specified port that does not require authentication or access control, enabling unauthenticated access to security-sensitive functions of the PLC. This allows potential attackers to interact with critical control functions remotely without any privilege requirements or user interaction. The vulnerability is rated critical with a CVSS 4.0 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

The vulnerability allows unauthenticated remote attackers to access and potentially manipulate critical functions of the DVP-12SE PLC via the exposed Modbus TCP service. This can lead to unauthorized control, disruption, or manipulation of industrial processes managed by the PLC. The high CVSS score reflects severe impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network-level mitigations such as isolating the PLC from untrusted networks, restricting access to the Modbus TCP port, and deploying network segmentation or firewall rules to limit exposure are recommended. Monitor vendor channels for updates and official patches.