---
id: "CVE-2026-22105"
kind: "vulnerability"
aliases: ["CVE-2026-22105"]
title: "Delta UFC500 EV chargers: default Service password derived from serial number"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "UFC500", "fixed": ["2.4.18"], "affected": "< 2.4.18; < 4.4.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["default-credentials", "delta-ufc500", "ev-charging", "industrial-control", "infrastructure", "iot", "ocpp"]
not_affected_if: ["changed-service-password", "credentials-changed", "isolated-network", "no-ufc500-deployed"]
published_at: "2026-10-30T11:17:32+00:00"
first_seen_at: "2026-10-30T11:29:51+00:00"
updated_at: "2026-10-30T11:34:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22105", "first_seen_at": "2026-10-30T11:29:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T11:34:48+00:00"}]
---

# Delta UFC500 EV chargers: default Service password derived from serial number

Delta UFC500 charging stations build the default password for their Service account from fixed character positions of the device serial number. An attacker on the same local network can rebuild that password, or brute-force the small remaining keyspace, and log in to read and change settings such as the OCPP backend address.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:UFC500 affected < 2.4.18; < 4.4.1 fixed 2.4.18

## How to check

- Look up the Service account on each UFC500 charger; if the default password has not been changed, the device is exposed.
- Check whether the charger's admin or web interface is reachable from networks other than the charger's own network.
- Confirm the firmware version against the vendor's advisory: unknown from the sources.

## Fix

Set a non-default password for the Service account (CNA remediation). Firmware per CNA record: 2.4.18 on the 2.4 branch is listed unaffected; for the 4.x branch the record lists <4.4.1 as affected. Not confirmed on a vendor page.

## Timeline

- 2026-10-30T11:29:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-22105
- 2026-10-30T11:34:48+00:00 analyst — CNA is DIVD (csirt.divd.nl/CVE-2026-22105, DIVD-2026-00012); those pages and Delta's advisory page returned nothing to me, so I read the CNA record via OpenCVE mirror only. No vendor page read, nothing verified. Record lists two firmware branches: <2.4.18 affected (2.4.18 unaffected) and <4.4.1 affected; the second branch's fixed version is unclear. CNA remediation is only 'set non-default Service password'. Sibling DIVD CVE-2026-22114 (no brute-force lockout) compounds this. CVSS v4 8.7, AV:A. Settle with DIVD page or Delta advisory.

## Documents

- [describes] OpenCVE mirror of DIVD CNA record CVE-2026-22105 https://app.opencve.io/cve/CVE-2026-22105

## From the sources

Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_