{"id":"CVE-2026-22105","kind":"vulnerability","aliases":["CVE-2026-22105"],"related":[],"title":"Delta UFC500 EV chargers: default Service password derived from serial number","description":"Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.","summary":"Delta UFC500 charging stations build the default password for their Service account from fixed character positions of the device serial number. An attacker on the same local network can rebuild that password, or brute-force the small remaining keyspace, and log in to read and change settings such as the OCPP backend address.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"UFC500","fixed":["2.4.18"],"affected":"< 2.4.18; < 4.4.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["default-credentials","delta-ufc500","ev-charging","industrial-control","infrastructure","iot","ocpp"],"not_affected_if":["changed-service-password","credentials-changed","isolated-network","no-ufc500-deployed"],"how_to_check":"- Look up the Service account on each UFC500 charger; if the default password has not been changed, the device is exposed.\n- Check whether the charger's admin or web interface is reachable from networks other than the charger's own network.\n- Confirm the firmware version against the vendor's advisory: unknown from the sources.","fix":"Set a non-default password for the Service account (CNA remediation). Firmware per CNA record: 2.4.18 on the 2.4 branch is listed unaffected; for the 4.x branch the record lists <4.4.1 as affected. Not confirmed on a vendor page.","status":"open","published_at":"2026-10-30T11:17:32+00:00","first_seen_at":"2026-10-30T11:29:51+00:00","triaged_at":"2026-10-30T11:31:26+00:00","updated_at":"2026-10-30T11:34:48+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-30T11:31:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Delta UFC500 EV chargers: default Service password derived from serial number","impact":"medium","summary":"Delta UFC500 charging stations build the default password for their Service account from fixed character positions of the device serial number. An attacker on the same local network can rebuild that password, or brute-force the small remaining keyspace, and log in to read and change settings such as the OCPP backend address.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ev-charging","delta-ufc500","ocpp","iot","industrial-control"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as Service account and changes OCPP backend settings","analyst_note":"Find the vendor advisory or firmware fix for UFC500 and confirm the Service account default credential scheme; the NVD entry alone does not state a fixed version.","how_to_check":"- Look up the Service account on each UFC500 charger; if the default password has not been changed, the device is exposed.\n- Check whether the charger's admin or web interface is reachable from networks other than the charger's own network.\n- Confirm the firmware version against the vendor's advisory: unknown from the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["credentials-changed","isolated-network","no-ufc500-deployed"],"who_is_affected":"Operators who run Delta UFC500 charging stations, especially where the chargers sit on a network that other devices or people can reach. Exposure depends on the Service account still using its default credentials; sites that have changed those credentials or isolated the chargers on a separate network are less exposed. The sources do not name a patched firmware version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4116,"output_tokens":625,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or firmware fix for UFC500 and confirm the Service account default credential scheme; the NVD entry alone does not state a fixed version.","search":"'-2026':13A,16A '-22105':14A,17A 'access':114C 'account':45B,99C 'address':87B 'adjac':112C 'attack':56B,110C 'backend':86B,137C 'brute':68B 'brute-forc':67B 'build':38B 'chang':80B,130C 'charact':48B,101C 'charg':27B,36B,90C 'charger':4A 'control':30B 'credenti':21B,95C 'cve':12A,15A 'default':5A,20B,40B,94C 'default-credenti':19B 'delta':1A,23B,34B,88C 'delta-ufc500':22B 'deriv':8A,92C 'devic':52B,105C 'ev':3A,26B 'ev-charg':25B 'exhaust':121C 'fix':47B 'forc':69B 'industri':29B 'industrial-control':28B 'infrastructur':31B 'iot':32B 'keyspac':73B,123C 'local':60B 'log':75B,125C 'network':61B,113C 'number':11A,54B,107C 'ocpp':33B,85B,136C 'password':7A,41B,65B,119C 'posit':49B,102C 'read':78B,128C 'rebuild':63B 'reconstruct':116C 'remain':72B 'result':118C 'sensit':131C 'serial':10A,53B,106C 'servic':6A,44B,98C 'set':81B,132C 'small':71B 'station':37B,91C 'ufc500':2A,18A,24B,35B,89C 'unauthent':109C","nicknames":[],"mitigations":[],"who_affected":"Delta UFC500 EV chargers still using the factory Service-account password, which is built from the device serial number. An attacker needs adjacent network access (same LAN or segment as the charger). Chargers with a changed Service password or on isolated networks can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T11:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"csirt@divd.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-22105","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22105","severity":null,"published_at":"2026-10-30T11:17:32+00:00","modified_at":"2026-10-30T11:17:32+00:00","first_seen_at":"2026-10-30T11:29:51+00:00","fetched_at":"2026-10-30T11:29:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-22105:1149","url":null,"severity":null,"published_at":"2026-10-30T11:34:48+00:00","modified_at":"2026-10-30T11:34:48+00:00","first_seen_at":"2026-10-30T11:34:48+00:00","fetched_at":"2026-10-30T11:34:48+00:00","note":"CNA is DIVD (csirt.divd.nl/CVE-2026-22105, DIVD-2026-00012); those pages and Delta's advisory page returned nothing to me, so I read the CNA record via OpenCVE mirror only. No vendor page read, nothing verified. Record lists two firmware branches: <2.4.18 affected (2.4.18 unaffected) and <4.4.1 affected; the second branch's fixed version is unclear. CNA remediation is only 'set non-default Service password'. Sibling DIVD CVE-2026-22114 (no brute-force lockout) compounds this. CVSS v4 8.7, AV:A. Settle with DIVD page or Delta advisory."}],"documents":[{"id":23157,"url":"https://app.opencve.io/cve/CVE-2026-22105","title":"OpenCVE mirror of DIVD CNA record CVE-2026-22105","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}