{"id":"CVE-2026-22109","kind":"vulnerability","aliases":["CVE-2026-22109"],"related":[],"title":"WebUI template database ships factory default passwords for five account types","description":"The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.","summary":"The shipped WebUI template database keeps the factory default passwords for all five account types in cleartext. The defaults are identical across devices, and an attacker who knows them can log in as those accounts.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Delta UFC500 WebUI","fixed":[],"affected":"< 1.4.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["default-credentials","delta-electronics","embedded-devices","infrastructure","ufc500","webui"],"not_affected_if":["default-passwords-changed"],"how_to_check":"- Identify Delta Electronics UFC500 units and the WebUI version (affected: below 1.4.7; the msi-image 2.4.18 status is unknown)\n- Try logging in to each of the five account types with the factory defaults; if one works, the device is exposed\n- The CVSS vector is local access with low privileges, so also check who can reach the device's files or shell","fix":"Not confirmed by a vendor page. NVD lists WebUI affected below 1.4.7, so 1.4.7 or later is probably the fixed line; confirm with Delta. Regardless, change all five default account passwords.","status":"open","published_at":"2026-10-30T11:17:32+00:00","first_seen_at":"2026-10-30T11:29:51+00:00","triaged_at":"2026-10-30T11:31:25+00:00","updated_at":"2026-10-30T11:32:33+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-30T11:31:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"WebUI template database ships factory default passwords for five account types","impact":"high","summary":"The shipped WebUI template database keeps the factory default passwords for all five account types in cleartext. The defaults are identical across devices, and an attacker who knows them can log in as those accounts.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["webui","embedded-devices"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in to device accounts using known default passwords","analyst_note":"Identify the affected product and versions and the vendor fix from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-22109; sources give no product, version or fix.","how_to_check":"- Look in the shipped WebUI template database for the default credentials stored in cleartext\n- Check whether the factory default passwords were changed on the device, since the tested unit still had them","plain_action":"","needs_analyst":true,"not_affected_if":["default-passwords-changed"],"who_is_affected":"Devices shipping with this WebUI template database and unchanged factory default passwords are exposed. The sources do not name the product or the device family, so which systems to inspect is unknown. Teams whose devices had their default passwords changed are not affected by the stored defaults.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000662,"input_tokens":4069,"output_tokens":510,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and versions and the vendor fix from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-22109; sources give no product, version or fix.","search":"'-2026':13A,16A '-22109':14A,17A 'account':10A,46B,67B,81C 'across':54B,88C 'attack':58B 'cleartext':49B,84C 'credenti':23B 'cve':12A,15A 'databas':3A,37B,72C 'default':6A,22B,41B,51B,76C,85C 'default-credenti':21B 'delta':18A,25B 'delta-electron':24B 'devic':29B,55B,89C 'electron':26B 'embed':28B 'embedded-devic':27B 'factori':5A,40B,75C 'five':9A,45B,80C 'ident':53B,87C 'infrastructur':30B 'keep':38B 'know':60B 'log':63B 'password':7A,42B,77C 'retain':73C 'ship':4A,34B,69C 'templat':2A,36B,71C 'test':95C 'type':11A,47B,82C 'ufc500':19A,31B 'unchang':92C 'unit':96C 'webui':1A,20A,32B,35B,70C","nicknames":[],"mitigations":[],"who_affected":"Delta Electronics UFC500 devices running WebUI below 1.4.7 (the msi-image 2.4.18 status is unknown) are exposed because all five account types ship with identical cleartext default passwords in the template database. Look at any UFC500 in industrial or building networks where defaults were never changed. Units whose passwords were all changed, or that nobody untrusted can reach, can mostly skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T11:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"csirt@divd.nl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-22109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22109","severity":null,"published_at":"2026-10-30T11:17:32+00:00","modified_at":"2026-10-30T11:17:32+00:00","first_seen_at":"2026-10-30T11:29:51+00:00","fetched_at":"2026-10-30T11:29:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-22109:1148","url":null,"severity":null,"published_at":"2026-10-30T11:32:33+00:00","modified_at":"2026-10-30T11:32:33+00:00","first_seen_at":"2026-10-30T11:32:33+00:00","fetched_at":"2026-10-30T11:32:33+00:00","note":"NVD record (CNA DIVD) names Delta Electronics Delta UFC500: WebUI < 1.4.7 affected; msi-image 2.4.18 status unknown. No vendor advisory or DIVD page found (csirt.divd.nl pages unreadable; DIVD-2026-00012 listed in cases as MikroTik, so that NVD reference looks mismatched). Fixed version 1.4.7 is inferred from the range, not stated; nothing verified. Sibling CVE-2026-22114 same product."}],"documents":[{"id":23153,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-22109","title":"NVD record CVE-2026-22109 (CNA: DIVD CSIRT)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}