Delta UFC500 CVE-2026-22109

The exact trigger is that the shipped WebUI template database stores the factory default passwords for all five account types in cleartext, and those defaults are identical across all devices and were unchanged on the tested unit. Concretely, an attacker who can read the WebUI template database (the supplied vector's AV:L/PR:L implies local and low-privileged access to the device/database) recovers every account's credential; alternatively, once the universal defaults are known from any one unit they apply to all devices where operators have not changed them. The primary limiting factor is that exploitation of any single device via the recovered-from-DB path is gated by the local/low-privilege access the CVSS vector describes, and by whether the operator has rotated the factory passwords - devices with changed credentials are not exposed to the shared-default reuse. The available sources do not state whether these defaults are usable for network-facing WebUI login, so remote reachability is unverified.

Signals are mixed and point to a serious-but-not-emergency credential hygiene flaw rather than a mass-exploitable remote bug. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 8.4 and indicates local attack vector with low privileges required - i.e. this is not remote-unauthenticated despite being high-severity, which tempers raw-score urgency. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a prioritized-but-not-critical triage. There is no CISA KEV listing, no EPSS probability provided, and no public exploit or PoC referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The underlying weakness (CWE-1392, use of default credentials stored in cleartext, identical across all shipped devices) is inherently dangerous because once the shared defaults are learned from any single unit they apply to every unprovisioned device, giving the issue a low technical barrier even though the CVSS vector marks it local. Conflict to verify: the vector's AV:L/PR:L implies an attacker already needs local/low-privileged access to read the template database, yet the 'identical across devices' nature means defaults can be harvested once and reused broadly - treat the practical blast radius as larger than AV:L alone suggests, and confirm with Delta/DIVD whether the WebUI is reachable with these defaults over the network.

An attacker obtains one Delta UFC500 unit (or local/low-privileged access to a deployed one) and reads the shipped WebUI template database, recovering the cleartext factory passwords for all five account types. Because these defaults are identical across every device and are frequently left unchanged (as on the tested unit), the attacker then authenticates to other UFC500 devices using the same credentials. No public exploit code is required or identified; the attack relies only on knowledge of the recovered shared defaults.