Live › vulnerability › CVE-2026-22105
Delta UFC500 charging stations build the default password for their Service account from fixed character positions of the device serial number. An attacker on the same local network can rebuild that password, or brute-force the small remaining keyspace, and log in to read and change settings such as the OCPP backend address.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 11:29 UTC. All times on this page are UTC.
Delta UFC500 EV chargers still using the factory Service-account password, which is built from the device serial number. An attacker needs adjacent network access (same LAN or segment as the charger). Chargers with a changed Service password or on isolated networks can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| UFC500 | vendor | < 2.4.18; < 4.4.1 | 2.4.18 |
2.4.18 on the 2.4 branch is listed unaffected; for the 4.x branch the record lists <4.4.1 as affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.
This page as .md · .json · in your agent: get_signal("CVE-2026-22105")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.