Trio of Critical Bugs Spotted in Delta Industrial PLCs

Researchers have identified one high- and three critical-severity vulnerabilities in Delta Electronics’ DVP-12SE11T PLC, a device popular at industrial sites across Asia, including water treatment and food and beverage processing. In August 2025, OPSWAT Unit 515 researchers cracked into the PLC and found four serious flaws, three of which scored above 9 out of 10 on CVSS.

Delta Electronics pushed a firmware fix for all four vulnerabilities just before the 2026 New Year, but the article notes that many OT networks run 24/7 and may be slow to patch. The four vulnerabilities are CVE-2025-15102 (CVSS 9.1, critical), CVE-2025-15103 (CVSS 9.8, critical), CVE-2025-15358 (CVSS 7.1, high), and CVE-2025-15359 (CVSS 9.1, critical), with issues including lack of authentication enforcement, weaknesses in authentication handling, insufficient memory validation, and an out-of-bounds write.

According to OPSWAT’s Unit 515 lead, vulnerable PLCs can directly affect physical processes and potentially cause unsafe conditions, while industry observers note that state-level attackers—particularly China—are active in this space and that groups such as Volt Typhoon, UNC3886 and APT41 are plausible OT targets.