Read the docs
TI-2026-82975 Aliases CVE-2026-22110GHSA-5fcx-qv97-pcff

Missing authentication check on POST and PUT requests in Delta UFC500

Priority LOW 39CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Delta UFC500 versions from 0 before 2.4.18 and from 0 before 4.4.1 have a missing authentication check in their web server. The server does not check authentication on POST or PUT requests (CWE-306). An unauthenticated attacker on an adjacent network can reboot the charger and, by guessing the configid, set the service password and change any setting.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0024 15th percentileScored 2026-11-07
Fix Fixed Delta UFC500 (Delta Electronics): 2.4.18, 4.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Delta ElectronicsDelta UFC500before 2.4.182.4.18Patch availableCNA
Delta ElectronicsDelta UFC500before 4.4.14.4.1Patch availableCNA
  • Delta UFC500 VendorDelta Electronics Affected before 2.4.18 Fixed in 2.4.18 Patch available CNA
  • Delta UFC500 VendorDelta Electronics Affected before 4.4.1 Fixed in 4.4.1 Patch available CNA

Remediation

Upgrade Delta UFC500 to version 2.4.18 or 4.4.1, depending on the release line in use. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA Delta UFC500 (Delta Electronics) Fixed in 2.4.18
  • Fix · CNA Delta UFC500 (Delta Electronics) Fixed in 4.4.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Delta UFC500 2.4.18, 4.4.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-82973 Default password derived from serial number in Delta UFC500Priority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-22110
  2. 2026-10-30 Alias added: GHSA-5fcx-qv97-pcff
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: MEDIUM → LOW

References

Advisory 2

  • TI-2021-16010 Delta Electronics DOPSoft 2 Out-of-Bounds Write KEVCVSS 3.1HIGH 7.8
  • TI-2023-01071 Deserialization of untrusted data in Delta Electronics InfraSuite Device Master CVSS 3.1CRITICAL 9.8
  • TI-2024-04235 Delta Electronics DIAEnergie SQL Injection CVSS 3.1HIGH 7.5
  • TI-2024-04234 Delta Electronics DIAEnergie SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2022-20149 Path traversal in Delta Electronics InfraSuite Device Master CVSS 3.1CRITICAL 9.8
  • TI-2024-18749 Delta Electronics DIAEnergie Path traversal CVSS 3.1HIGH 8.1
See all 229 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences