HTTP Basic Authentication Flaw in Service Password Management by Vendor
CVE-2026-22114

5.3MEDIUM

Key Information:

Vendor

Delta Electronics
Status
Delta Ufc500
Vendor
CVE Published:
30 October 2026

What is CVE-2026-22114?

A flaw exists in the HTTP basic authentication mechanism where there is no limit imposed on retries or backoff policies. This vulnerability can be exploited, especially when combined with the default service password, which leads to an exhaustible keyspace, allowing attackers to potentially gain unauthorized access. Properly implementing rate limiting and improving password policies is crucial to mitigate risks associated with this vulnerability.

Affected Version(s)

Delta UFC500 2.4.18

Delta UFC500 0 < 4.4.2

References

https://csirt.divd.nl/DIVD-2026-00012
third-party-advisory
https://csirt.divd.nl/CVE-2026-22114
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wilco van Beijnum (Elaadnl)
Victor Pasman
.