CVE-2026-22105
High
Description
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.
SeverityHigh
CVSS8.7
Exploit probability—
ProductDelta UFC500
PublishedOct 30, 2026
First seenNov 4, 2026
Weakness typeCWE-1392CWE-1392
How to fix
Update
- Delta Electronics Delta UFC5002.4.18, 4.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Delta Electronics Delta UFC500 | v < 2.4.18, v < 4.4.1 | 2.4.18, 4.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.