Live › vulnerability › CVE-2026-22110
Delta Electronics UFC500 DC fast-charger web server does not check authentication on POST/PUT. An unauthenticated attacker on the adjacent network can reboot the charger and, by brute-forcing the configid, set the service password and change any setting.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 11:29 UTC. All times on this page are UTC.
Affects EV charging hardware whose web interface is reachable on the network; the sources do not name the vendor, model or firmware range. The exposure depends on whether the charger's web server is reachable from untrusted networks. unknown
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Delta UFC500 | vendor | < 2.4.18 | 2.4.18 |
2.4.18 are affected2.4.18 or later (per CNA record via OpenCVE; vendor advisory not yet read)4.4.1; confirm with Delta which applies to your unitEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
This page as .md · .json · in your agent: get_signal("CVE-2026-22110")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.