---
id: "CVE-2026-22109"
kind: "vulnerability"
aliases: ["CVE-2026-22109"]
title: "WebUI template database ships factory default passwords for five account types"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Delta UFC500 WebUI", "fixed": [], "affected": "< 1.4.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["default-credentials", "delta-electronics", "embedded-devices", "infrastructure", "ufc500", "webui"]
not_affected_if: ["default-passwords-changed"]
published_at: "2026-10-30T11:17:32+00:00"
first_seen_at: "2026-10-30T11:29:51+00:00"
updated_at: "2026-10-30T11:32:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22109", "first_seen_at": "2026-10-30T11:29:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T11:32:33+00:00"}]
---

# WebUI template database ships factory default passwords for five account types

The shipped WebUI template database keeps the factory default passwords for all five account types in cleartext. The defaults are identical across devices, and an attacker who knows them can log in as those accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Delta UFC500 WebUI affected < 1.4.7 fixed ?

## How to check

- Identify Delta Electronics UFC500 units and the WebUI version (affected: below 1.4.7; the msi-image 2.4.18 status is unknown)
- Try logging in to each of the five account types with the factory defaults; if one works, the device is exposed
- The CVSS vector is local access with low privileges, so also check who can reach the device's files or shell

## Fix

Not confirmed by a vendor page. NVD lists WebUI affected below 1.4.7, so 1.4.7 or later is probably the fixed line; confirm with Delta. Regardless, change all five default account passwords.

## Timeline

- 2026-10-30T11:29:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-22109
- 2026-10-30T11:32:33+00:00 analyst — NVD record (CNA DIVD) names Delta Electronics Delta UFC500: WebUI < 1.4.7 affected; msi-image 2.4.18 status unknown. No vendor advisory or DIVD page found (csirt.divd.nl pages unreadable; DIVD-2026-00012 listed in cases as MikroTik, so that NVD reference looks mismatched). Fixed version 1.4.7 is inferred from the range, not stated; nothing verified. Sibling CVE-2026-22114 same product.

## Documents

- [advisory] NVD record CVE-2026-22109 (CNA: DIVD CSIRT) https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-22109

## From the sources

The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_