Delta UFC500 vulnerabilities

3 known vulnerabilities in Delta UFC500 from Delta Electronics. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  Delta UFC500: Missing Authentication for Critical Functionality

  CVE-2026-22110Oct 30, 2026Delta Electronics

  The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.

• 8.4 High severity

  Delta UFC500: Use of Default Credentials

  CVE-2026-22109Oct 30, 2026Delta Electronics

  The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.

• 8.7 High severity

  Delta UFC500: Use of Default Credentials

  CVE-2026-22105Oct 30, 2026Delta Electronics

  Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace,