Posting mode: Reply

Delta — Plc The Password Function Is Ineffective

[Your Name/Institution]

The password protection feature on Delta PLCs (e.g., DVP, AS, and AH series) is marketed as a means to "protect intellectual property" and "prevent unauthorized program modifications." Typically, a user sets an 8-character (or less) alphanumeric password via the ISPSoft or WPLSoft programming software. However, unlike IT systems, PLC password mechanisms are often implemented at the application layer of a proprietary or semi-standard industrial protocol, not as part of a robust security architecture. This paper investigates why this function fails against a motivated adversary.

The password function fails against three core security requirements:

Beyond Obscurity: Analyzing the Ineffectiveness of the Password Protection Function in Delta PLCs as a Security Control

We set up a test environment: a Delta DVP-14SS2 PLC (RS-232/RS-485) and a Delta AS228T (Ethernet). A password was set using ISPSoft.