Delta UFC500 CVE-2026-22110

Requires adjacent-network access (AV:A) to the UFC500's web server - the attacker must reach the device over the local/adjacent network segment, not the open internet. No authentication is required (PR:N) and no user interaction (UI:N), so the reboot action works against default configurations of the Delta UFC500 by any party who can send HTTP POST/PUT to the interface. The more impactful capability - setting the service password and changing arbitrary settings - additionally requires brute-forcing the configid value, which is the one practical limiting factor; network segmentation or isolating the charger's management interface from untrusted hosts substantially reduces realistic exposure.

This is a genuine high-severity authentication bypass (CWE-306, missing authentication for critical functions) but several signals temper the urgency. The CVSS 4.0 base score of 8.7 is driven by PR:N/UI:N (no authentication, no user interaction) combined with high confidentiality and integrity impact (VC:H/VI:H) and partial availability impact (VA:L). Critically, the attack vector is AV:A (Adjacent), NOT network/internet-wide - exploitation requires the attacker to be on the same local or adjacent network segment as the charger's web interface, which meaningfully constrains the exposed population versus a true remote (AV:N) flaw. The DIVD/vuln.today SSVC-style decision label is 'this_week', indicating prompt but not emergency remediation. No EPSS score was provided, the CVE is NOT in CISA KEV (no confirmed active exploitation), and no proof-of-concept or exploit reference is present in the input. The signals are therefore internally consistent rather than conflicting: high technical impact and trivial complexity (AC:L, AT:N) justify the elevated score, while the adjacent-only vector plus absence of KEV/EPSS/PoC indicate this is a serious issue for exposed OT/EV-charging networks rather than evidence of widespread opportunistic exploitation. Note the two-tier impact: rebooting the charger is trivially unauthenticated, while full setting modification additionally requires brute-forcing the configid value, a modest added barrier.

An attacker with access to the same network segment as the Delta UFC500 charger (e.g., a compromised device on the OT/charging LAN) sends an unauthenticated POST or PUT request to the web server to reboot the unit, causing denial of service. To escalate, the attacker brute-forces the configid parameter, sets the service password, and then modifies any device setting to take full administrative control. No public exploit code is identified at the time of analysis, so this would require custom tooling against the device's HTTP interface.