Unauthorized Access in Delta UFC500 Charging Stations Due to Weak Credential Handling
CVE-2026-22105

8.7HIGH

Key Information:

Vendor

Delta Electronics
Status
Delta Ufc500
Vendor
CVE Published:
30 October 2026

What is CVE-2026-22105?

The Delta UFC500 charging stations exhibit a vulnerability where the default credentials for the service account are derived from the character positions of the device serial number. This design flaw allows an unauthenticated attacker with adjacent network access to reconstruct the password or perform a keyspace exhaustion attack. Once accessed, the attacker can view and alter critical settings, including configurations related to the Open Charge Point Protocol (OCPP) backend, leading to potential unauthorized control over the device.

Affected Version(s)

Delta UFC500 0 < 2.4.18

Delta UFC500 0 < 4.4.1

Delta UFC500 2.4.18

References

https://csirt.divd.nl/DIVD-2026-00012
third-party-advisory
https://csirt.divd.nl/CVE-2026-22105
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wilco van Beijnum (Elaadnl)
Victor Pasman (DIVD)
.