CVE-2026-22105
Received Received - Intake

Delta UFC500 Charging Stations Default Credentials Exposure

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Dutch Institute for Vulnerability Disclosure

Description
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-22105
EUVD
EUVD-2026-113764

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Delta Electronics Delta UFC500 0
Delta Electronics Delta UFC500 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1392 The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Delta UFC500 charging stations use a weak method to generate default credentials for the Service account based on the device serial number. An attacker within network range can reverse-engineer the password by analyzing character positions in the serial number or brute-forcing the limited keyspace. This allows unauthorized access to sensitive settings like the OCPP backend.

Detection Guidance

Detecting this vulnerability requires checking if Delta UFC500 charging stations are using default credentials derived from serial numbers. Inspect device configurations for default Service account credentials and verify if passwords match expected patterns based on serial numbers. Network monitoring for unauthorized access attempts to charging stations may also help.

Impact Analysis

An attacker could gain control of the charging station, read or modify sensitive configurations, disrupt charging operations, or intercept data transmitted to the OCPP backend. This may lead to service outages, data breaches, or unauthorized billing manipulation.

Mitigation Strategies

Immediately change default credentials on Delta UFC500 charging stations to strong, unique passwords not derived from serial numbers. Ensure network segmentation to limit adjacent network access to these devices. Regularly audit device configurations and credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-22105. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart