Read the docs
TI-2026-82973 Aliases CVE-2026-22105GHSA-qgx4-4f35-7645

Default password derived from serial number in Delta UFC500

Priority LOW 39CWE-1392Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Delta UFC500 charging stations before 2.4.18 and before 4.4.1 derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend. This weakness is classified as CWE-1392.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Fix Fixed Delta UFC500 (Delta Electronics): 2.4.18, 4.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Delta ElectronicsDelta UFC500before 2.4.182.4.18Patch availableCNA
Delta ElectronicsDelta UFC500before 4.4.14.4.1Patch availableCNA
  • Delta UFC500 VendorDelta Electronics Affected before 2.4.18 Fixed in 2.4.18 Patch available CNA
  • Delta UFC500 VendorDelta Electronics Affected before 4.4.1 Fixed in 4.4.1 Patch available CNA

Remediation

Update Delta UFC500 to version 2.4.18 or 4.4.1, which fix the flaw in their respective release lines.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA Delta UFC500 (Delta Electronics) Fixed in 2.4.18
  • Fix · CNA Delta UFC500 (Delta Electronics) Fixed in 4.4.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Delta UFC500 2.4.18, 4.4.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-82975 Missing authentication check on POST and PUT requests in Delta UFC500Priority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-22105
  2. 2026-10-30 Alias added: GHSA-qgx4-4f35-7645
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: MEDIUM → LOW

References

Advisory 2

  • TI-2021-16010 Delta Electronics DOPSoft 2 Out-of-Bounds Write KEVCVSS 3.1HIGH 7.8
  • TI-2023-01071 Deserialization of untrusted data in Delta Electronics InfraSuite Device Master CVSS 3.1CRITICAL 9.8
  • TI-2024-04235 Delta Electronics DIAEnergie SQL Injection CVSS 3.1HIGH 7.5
  • TI-2024-04234 Delta Electronics DIAEnergie SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2022-20149 Path traversal in Delta Electronics InfraSuite Device Master CVSS 3.1CRITICAL 9.8
  • TI-2024-18749 Delta Electronics DIAEnergie Path traversal CVSS 3.1HIGH 8.1
See all 229 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences