Delta UFC500 CVE-2026-22114

Requires an attacker on an adjacent network segment (AV:A) able to reach the device's HTTP basic authentication endpoint; exploitation is enabled by two combined conditions stated in the description - the auth implementation enforcing no retry limit or backoff, and the presence of a default service password that makes the keyspace exhaustible. Limiting factors: the vector is adjacent rather than internet-remote, so an on-network position is prerequisite; impact is limited to low confidentiality disclosure (no integrity or availability effect); and if the default service password has been changed to a strong unique value, brute-force exhaustion becomes substantially harder, materially reducing practical risk even though the missing rate-limiting remains.

The input provides a CVSS 4.0 base score of 5.3 (medium) with vector AV:A/AC:L/AT:N/PR:N/UI:N and only low confidentiality impact (VC:L, VI:N, VA:N) - no integrity or availability impact and no scope change. Attack vector is Adjacent (AV:A), meaning exploitation requires a foothold on the same logical/physical network segment, not open internet reach; this materially caps real-world exposure compared with a true AV:N network flaw. No EPSS score was supplied, no CISA KEV listing is present, and no PoC/exploit reference is provided - only a DIVD CSIRT advisory. The vuln.today decision label is 'this_month', indicating a moderate, scheduled-remediation priority rather than act_now or emergency. The underlying weakness (CWE-307) is concrete and credible: HTTP basic auth with no retry limit or backoff combined with a known default service password makes the credential keyspace exhaustible by brute force. Overall this is a real but bounded issue - the mechanism is clear and reliable where the default password persists, but the adjacent-only vector, low-only confidentiality impact, and absence of KEV/EPSS/PoC signals place it below high-urgency network-exploitable criticals. Missing data to note explicitly: no EPSS probability was provided and no CVSS 3.1 vector was supplied (only CVSS 4.0), so cross-framework severity cannot be independently reconciled from the input.

An attacker positioned on the same adjacent network as a Delta UFC500 device reaches its HTTP basic auth endpoint and submits repeated credential guesses. Because no retry limit or backoff is enforced and a default service password is known, the attacker exhausts the credential keyspace (or simply uses the default) to authenticate and obtain the low-impact information the interface exposes. No public exploit identified at time of analysis; only a DIVD advisory reference is provided.