A resource allocation flaw with no limits or throttling in the Modbus TCP service of the Delta Electronics DVP-12SE PLCs means that an attacker can send a large amount of requests and exhaust CPU, memory, or other critical resources, resulting in a loss of availability for the device and any processes that depend on it. The vulnerability is classified as CWE-770, a resource exhaustion weakness. The flaw can be leveraged from a remote network connection to the Modbus port, potentially disrupting operational control systems.

Delta Electronics DVP-12SE programmable logic controllers are affected. No specific firmware or product versions were disclosed, so the issue likely applies to all releases that include the Modbus TCP service.

The CVSS base score of 9.3 indicates a high severity risk. Although the EPSS score is not available, the absence of a set throttling limit suggests that exploitation is straightforward for an attacker. The likely attack vector is inferred from the description to be a flood of Modbus TCP requests sent over an external network connection to the PLC’s Modbus port, potentially exhausting device resources and causing a denial of service. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS and inferred ease of exploitation mean that immediate mitigation is advisable.