Live › vulnerability › CVE-2026-22109
The shipped WebUI template database keeps the factory default passwords for all five account types in cleartext. The defaults are identical across devices, and an attacker who knows them can log in as those accounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 11:29 UTC. All times on this page are UTC.
Delta Electronics UFC500 devices running WebUI below 1.4.7 (the msi-image 2.4.18 status is unknown) are exposed because all five account types ship with identical cleartext default passwords in the template database. Look at any UFC500 in industrial or building networks where defaults were never changed. Units whose passwords were all changed, or that nobody untrusted can reach, can mostly skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Delta UFC500 WebUI | vendor | < 1.4.7 | – |
1.4.7, so 1.4.7 or later is probably the fixed line; confirm with DeltaEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
This page as .md · .json · in your agent: get_signal("CVE-2026-22109")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.