CVE-2025-15359
Out-of-Bounds Write in DVP-12SE11T Risks Memory Corruption
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: Deltaww
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| delta_electronics | dvp-12se11t | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can have a critical impact, as indicated by its CVSS score of 9.1. It can lead to denial of service (device crashes) or allow an attacker to execute arbitrary code on the affected device, potentially compromising the device's integrity and availability. This could disrupt industrial control processes relying on the device. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2025-15359, upgrade the device firmware to version 2.16 or later. Additionally, implement network-level countermeasures such as using IP whitelisting to restrict Modbus/TCP access to trusted IP addresses, applying network segmentation to isolate the device, and deploying industrial firewalls to monitor Modbus/TCP traffic. General security practices include avoiding exposure of control systems to the internet, placing systems behind firewalls and isolating them from business networks, and using secure remote access methods like VPNs. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how the CVE-2025-15359 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2025-15359 is an out-of-bounds memory write vulnerability (CWE-787) affecting the Delta Electronics DVP-12SE 11T product, specifically firmware versions prior to v2.16. This means that the device's firmware improperly writes data outside the allocated memory boundaries, which can lead to corruption of memory, crashes, or potentially allow an attacker to execute arbitrary code. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The provided resources do not include specific detection methods or commands to identify the CVE-2025-15359 vulnerability on a network or system. The recommended mitigation is to upgrade the device firmware to version 2.16 or later. General security recommendations include network segmentation, using industrial firewalls to monitor Modbus/TCP traffic, and restricting Modbus/TCP access via IP whitelisting. However, no explicit detection commands or scanning techniques are provided. [1]