Delta UFC500 CVE-2026-22105

The attacker must be on an adjacent/local network segment reachable to the charger's management interface (AV:A) - this is NOT internet-wide remote exploitation, so exposure depends on whether the charger's local/management network is accessible (shared site LAN, management VLAN, or local wireless). No authentication is required (PR:N) and no user interaction is needed (UI:N). The specific prerequisite is knowledge of, or the ability to brute-force, the device serial number, because the Service-account password is derived from fixed character positions of that serial; the derivation collapses the password into a small, exhaustible keyspace. The main limiting factor is the adjacent-network requirement; chargers whose management plane is segmented away from untrusted users are substantially harder to reach.

This is a credible operational-priority issue rather than a CVSS-inflated one, but its reach is bounded by the access vector. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, low-complexity attack that requires adjacent (local/same-segment) network access rather than full internet exposure, with high confidentiality and integrity impact (VC:H/VI:H) and low availability impact (VA:L). The root cause (CWE-1392, use of default/derivable credentials) is concrete and reliable to exploit once an attacker is on the local segment, because the Service-account password is deterministically derived from the device serial number. The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency posture. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active or widespread exploitation - the AV:A constraint also argues against mass internet-wide automation. Net: treat as a prompt-remediation item for exposed/shared-network charger fleets, but it is not evidence of in-the-wild mass exploitation. Note a mild tension to verify with the vendor: the input Tags label this 'Information Disclosure', yet the description and VI:H indicate the attacker can also change settings (e.g. the OCPP backend), which is an integrity impact beyond pure disclosure.

An attacker who gains access to the same local network segment as a Delta UFC500 charging station (for example via an exposed management VLAN, shared site network, or local wireless) obtains or computes the Service-account password from the device serial number, or brute-forces the small derived keyspace. They then authenticate without any prior credentials and read or alter sensitive configuration such as the OCPP backend endpoint. No public exploit was identified in the provided data, but exploitation is low-complexity given the deterministic credential derivation.