Delta Electronics vulnerabilities
We track 147 vulnerabilities in Delta Electronics products across 23 products. 147 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 30, 2026.
Latest Delta Electronics vulnerabilities
- 8.7 High severity
Delta UFC500: Missing Authentication for Critical Functionality
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
- 8.4 High severity
Delta UFC500: Use of Default Credentials
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
- 8.7 High severity
Delta UFC500: Use of Default Credentials
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace,
- 7.8 High severity
DIAScreen: Out-of-bounds Write
Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.8 High severity
DIAScreen: Out-of-bounds Write
Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.8 High severity
DIAScreen: Out-of-bounds Write
Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.8 High severity
DIAScreen: Out-of-bounds Write
Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.8 High severity
CNCSoft-G2: Stack-based Buffer Overflow
Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.8 High severity
CNCSoft-G2: Stack-based Buffer Overflow
Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.3 High severity
CNCSoft-G2: Out-of-bounds Write
Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.3 High severity
CNCSoft: Out-of-bounds Write
Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.3 High severity
CNCSoft: Out-of-bounds Write
Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.3 High severity
CNCSoft: Out-of-bounds Write
Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 7.3 High severity
CNCSoft: Out-of-bounds Write
Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.
- 9.8 Critical severity
ISPSoft: Out-of-bounds Write
Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsing ISP file.
- 9.8 Critical severity
ISPSoft: Out-of-bounds Write
Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsing ISP file.
- 9.8 Critical severity
ISPSoft: Out-of-bounds Write
Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to execute arbitrary code when parsing DVP file.
- 9.8 Critical severity
ISPSoft: Out-of-bounds Write
Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsing DVP file.
- 9.8 Critical severity
ISPSoft: Out-of-bounds Write
Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to leverage debugging logic to execute arbitrary code when parsing CBDGL file.
- 9.8 Critical severity
COMMGR: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs (CWE-338). An attacker could easily brute force a session ID and load and execute arbitrary code.
- 7.8 High severity
CNCSoft-G2: Heap-based Buffer Overflow
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execu
- 7.8 High severity
CNCSoft-G2: Heap-based Buffer Overflow
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execu
- 7.8 High severity
DRASimuCAD: Access of Resource Using Incompatible Type
Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required to ex
- 7.8 High severity
DRASimuCAD: Out-of-bounds Write
Delta Electronics DRASimuCAD ICS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required
- 7.8 High severity
DRASimuCAD: Access of Resource Using Incompatible Type
Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required to ex
- 7.8 High severity
DIAScreen: Out-of-bounds Write
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjectInfo can be exploited, allowing the attacker to remotely execute arbitrary code.
- 7.8 High severity
DIAScreen: Out-of-bounds Write
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameter can be exploited, allowing the attacker to remotely execute arbitrary code.
- 7.8 High severity
DIAScreen: Out-of-bounds Write
If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the attacker to remotely execute arbitrary code.
- 9.8 Critical severity
InfraSuite Device Master: Deserialization of Untrusted Data
Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication.
- 7.8 High severity
CNCSoft-G2: Use of Uninitialized Resource
Delta Electronics CNCSoft-G2 lacks proper initialization of memory prior to accessing it. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process.
- 7.8 High severity
CNCSoft-G2: Out-of-bounds Read
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the
- 7.8 High severity
CNCSoft-G2: Out-of-bounds Write
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code
- 7.8 High severity
CNCSoft-G2: Out-of-bounds Write
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in th
- 7.8 High severity
CNCSoft-G2: Out-of-bounds Write
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can manipulate an insider to visit a malicious page or file to leverage this vulnerability to execute
- 9.8 Critical severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product.
- 8.8 High severity
DIAEnergie: Improper Neutralization of Special Elements used in an SQL Command
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product.
- 9.8 Critical severity
DTN Soft: Deserialization of Untrusted Data
Delta Electronics DTN Soft version 2.0.1 and prior are vulnerable to an attacker achieving remote code execution through a deserialization of untrusted data vulnerability.
- 8.8 High severity
CNCSoft-G2: Out-of-bounds Write
Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execu
- 8.8 High severity
CNCSoft-G2: Out-of-bounds Read
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute cod
- 8.8 High severity
CNCSoft-G2: Out-of-bounds Write
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the cont