Authentication Bypass in Web Server for Vulnerable Charging Stations by Vendor
CVE-2026-22110

8.7HIGH

Key Information:

Vendor

Delta Electronics
Status
Delta Ufc500
Vendor
CVE Published:
30 October 2026

What is CVE-2026-22110?

The web server utilized in various charging stations is susceptible to an authentication bypass issue. This vulnerability permits unauthenticated attackers to execute POST or PUT requests without proper validation. An attacker can exploit this weakness to reboot the charging station, modify critical settings, and reset the service password by brute-forcing the configuration ID. This can lead to unauthorized access and control over the device, compromising its intended functionality and security.

Affected Version(s)

Delta UFC500 0 < 2.4.18

Delta UFC500 0 < 4.4.1

Delta UFC500 2.4.18

References

https://csirt.divd.nl/DIVD-2026-00012
third-party-advisory
https://csirt.divd.nl/CVE-2026-22110
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wilco van Beijnum (Elaadnl)
Victor Pasman (DIVD)
.