Missing brute-force protection for web interface

HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.

Default WebUI passwords stored in plaintext

The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.

Use of default password based on serial number

Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.

Missing authentication check on POST/PUT requests

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.

DIAView - Authentication Bypass Vulnerability

Delta Electronics DIAView has multiple vulnerabilities.

DIAView - Authentication Bypass Vulnerability

Delta Electronics DIAView has multiple vulnerabilities.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

ASDA-Soft Stack-based Buffer Overflow Vulnerability

ASDA-Soft Stack-based Buffer Overflow Vulnerability

DIAView - Command Injection Vulnerability

Delta Electronics DIAView has Command Injection vulnerability.

DIAView - Authentication Bypass Vulnerability

Delta Electronics DIAView has an authentication bypass vulnerability.

File Parsing Deserialization of Untrusted Data in DTM Soft

DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability

File Parsing Memory Corruption in CNCSoft-G2

Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.

File Parsing Memory Corruption in CNCSoft-G2

Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.

DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information

DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information

DVP-12SE11T - Password Protection Bypass

DVP-12SE11T - Password Protection Bypass

DVP-12SE11T - Authentication Bypass via Partial Password Disclosure

DVP-12SE11T - Authentication Bypass via Partial Password Disclosure

DVP-12SE11T - Denial of Service Vulnerability

DVP-12SE11T - Denial of Service Vulnerability

DVP-12SE11T - Out-of-bound memory write Vulnerability

DVP-12SE11T - Out-of-bound memory write Vulnerability

ASDA-Soft Stack-based Buffer Overflow Vulnerability

ASDA-Soft Stack-based Buffer Overflow Vulnerability

ASDA-Soft Stack-based Buffer Overflow Vulnerability

ASDA-Soft Stack-based Buffer Overflow Vulnerability