Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-22114

Missing brute-force protection for web interface

HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Delta Electronics
Products
Delta Ufc500
CVE-2026-22109

Default WebUI passwords stored in plaintext

The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Delta Electronics
Products
Delta Ufc500
CVE-2026-22105

Use of default password based on serial number

Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Delta Electronics
Products
Delta Ufc500
CVE-2026-22110

Missing authentication check on POST/PUT requests

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Delta Electronics
Products
Delta Ufc500