Delta Electronics
Monthly
Delta UFC500 chargers expose web server POST and PUT actions without authentication, allowing an attacker on the adjacent network to reboot the device and, if the configid can be brute-forced, set the service password and alter arbitrary settings. The flaw is a CWE-306 missing-authentication issue rated CVSS 8.7, with high confidentiality and integrity impact and lower availability impact; the independent assessment notes that network segmentation or isolating the charger management interface materially reduces realistic exposure. No public exploit identified at time of analysis, and the vuln.today decision label is this_week.
Delta UFC500 charging stations generate the Service-account password from fixed character positions of the device serial number, so anyone who can reach the charger's management interface on an adjacent network segment can reconstruct that password - or brute-force the small resulting keyspace - and log in without credentials. Successful login gives read and write access to sensitive configuration, including the OCPP backend the station connects to, so an attacker could redirect charging traffic or alter operational settings. The access vector is adjacent/local, not internet-wide remote, so exposure depends on whether the management plane is reachable from a shared site LAN, management VLAN or local wireless; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though DIVD rates it a this-week operational priority.
Cleartext storage of universal factory default passwords in the Delta UFC500 WebUI template database lets an authenticated attacker with low local privileges recover credentials for all five account types. The defaults are identical across devices and were unchanged on the tested unit, so recovered credentials can be reused on any unit where operators have not rotated them; the sources do not confirm whether those defaults are usable for network-facing WebUI login. No public exploit identified at time of analysis, and the priority label is this_week rather than an emergency or KEV-confirmed active-exploitation signal.
Improper authentication in Delta Electronics DIAEnergie before 1.11.00.022 allows authentication bypass, enabling remote attackers to reach protected functionality without valid credentials. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires no authentication, no user interaction, and no non-default configuration - only network reachability to the DIAEnergie service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the practical exposure is limited chiefly by the product's footprint, as DIAEnergie is a niche ICS energy-management platform typically deployed on operational or enterprise networks rather than the public internet.
Delta UFC500 devices can be brute-forced through their HTTP basic authentication endpoint because the service enforces no retry limit or backoff and ships with a default service password, allowing an attacker positioned on an adjacent network segment to exhaust the keyspace and obtain low-sensitivity information. The CVSS 4.0 base score is 5.3 (medium), and the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N with only low confidentiality impact, so integrity and availability are unaffected and an on-segment network position is required. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the priority label is this_month.
An out-of-bounds memory write in the firmware of the Delta DVP-12SE11T programmable logic controller allows remote attackers to corrupt memory on a network-reachable device, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating no authentication or user interaction is required and full loss of confidentiality, integrity, and availability. The flaw is classified as CWE-787 (out-of-bounds write) and is reported against the DVP-12SE11T firmware with no version constraint in the CPE record, meaning all observed firmware builds of that model should be treated as affected until the vendor advisory (Delta PCSA-2025-00022) narrows the range. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; realistic exploitation depends on an attacker first reaching the controller on an OT/plant network segment, since the exact triggering protocol, port, or message type is not disclosed in the available data.
Denial of service in Delta Electronics DVP-12SE11T PLC firmware lets an unauthenticated, remote attacker crash or otherwise render the device unavailable (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The vulnerability stems from improper input validation (CWE-20) in the device's exposed network service, and the CPE entry cpe:2.3:o:deltaww:dvp-12se11t_firmware:* indicates all observed firmware versions are affected. Risk is moderate rather than critical: EPSS is 0.32% (23rd percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and the practical barrier is network reachability - the device is normally deployed inside segmented or air-gapped OT networks, where no authentication or user interaction is required once the attacker can reach the service.
Authentication bypass in Delta DVP-12SE11T PLCs allows remote, unauthenticated attackers to fully compromise the controller’s confidentiality, integrity, and availability (CVSS 9.8). The flaw (CWE-288) leverages an alternate authentication path in the firmware, requiring network access to the device's engineering or communication interface and no user interaction. No public exploit identified at time of analysis; exploitation is primarily limited by OT network segmentation and firewalling.
Cleartext transmission in Delta DVP-12SE PLC firmware causes sensitive Modbus/TCP traffic - process values, register contents, and control commands - to cross the network unencrypted and unauthenticated, letting an attacker on the same Layer-2 segment eavesdrop on, inject into, or modify communications with the device. The CVSS 4.0 base score of 7.2 is driven by the adjacency requirement (AV:A) and the absence of any authentication or user interaction (PR:N/UI:N), with impact scored as low confidentiality and high integrity/availability loss against the PLC itself; subsequent-system metrics are all None, so the flaw does not chain outward to other assets. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because exploitation demands a foothold on the OT/adjacent network rather than internet reachability, this is a moderate-priority ICS issue rather than an urgent internet-wide emergency.
Denial of service in Delta Electronics DVP15MC11T controllers can be triggered by malformed Modbus/TCP packets sent to the controller's unauthenticated port 502, causing availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms this is remotely reachable without authentication or user interaction, while confidentiality and integrity are not affected. No public exploit was identified at time of analysis, and EPSS is low at 0.22%, but exposure is highest where Modbus/TCP is reachable from untrusted networks rather than segmented OT networks.
A stack-based buffer overflow in Delta Electronics ASDA-Soft, the configuration utility for ASDA series servo drives, allows memory corruption when a local user opens a crafted project or configuration file. Affected are ASDA-Soft installations on engineering workstations (the CPE wildcard cpe:2.3:a:deltaww:asda_soft:*:*:*:*:*:*:*:* indicates all versions are in scope); exploitation requires the victim to actively open an attacker-supplied file and yields code execution in the context of the current user, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:N/UI:R/S:U). No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.20% (9th percentile), though the reliance on file-delivery social engineering to operator workstations keeps the residual risk non-trivial in industrial environments.
Stack-based buffer overflow in Delta Electronics' ASDA-Soft servo commissioning software can be triggered when a user opens a maliciously crafted project or configuration file, allowing arbitrary code execution, data corruption, or a crash at the privilege level of the user running the application. Because exploitation requires local access and the victim to actively open an untrusted file (AV:L, UI:R, PR:N, CVSS 7.8), it is not remotely exploitable and depends on social engineering rather than a network-reachable service. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.20% (9th percentile), indicating low predicted real-world exploitation, though the small and typically isolated OT/engineering installation base also limits mass-scanning activity.
An issue was discovered in Delta Electronics WPLSoft, Versions prior to V2.42.11, ISPSoft, Versions prior to 3.02.11, and PMSoft, Versions prior to2.10.10. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Delta Electronics WPLSoft, Versions prior to V2.42.11, ISPSoft, Versions prior to 3.02.11, and PMSoft, Versions prior to 2.10.10. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Delta UFC500 chargers expose web server POST and PUT actions without authentication, allowing an attacker on the adjacent network to reboot the device and, if the configid can be brute-forced, set the service password and alter arbitrary settings. The flaw is a CWE-306 missing-authentication issue rated CVSS 8.7, with high confidentiality and integrity impact and lower availability impact; the independent assessment notes that network segmentation or isolating the charger management interface materially reduces realistic exposure. No public exploit identified at time of analysis, and the vuln.today decision label is this_week.
Delta UFC500 charging stations generate the Service-account password from fixed character positions of the device serial number, so anyone who can reach the charger's management interface on an adjacent network segment can reconstruct that password - or brute-force the small resulting keyspace - and log in without credentials. Successful login gives read and write access to sensitive configuration, including the OCPP backend the station connects to, so an attacker could redirect charging traffic or alter operational settings. The access vector is adjacent/local, not internet-wide remote, so exposure depends on whether the management plane is reachable from a shared site LAN, management VLAN or local wireless; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though DIVD rates it a this-week operational priority.
Cleartext storage of universal factory default passwords in the Delta UFC500 WebUI template database lets an authenticated attacker with low local privileges recover credentials for all five account types. The defaults are identical across devices and were unchanged on the tested unit, so recovered credentials can be reused on any unit where operators have not rotated them; the sources do not confirm whether those defaults are usable for network-facing WebUI login. No public exploit identified at time of analysis, and the priority label is this_week rather than an emergency or KEV-confirmed active-exploitation signal.
Improper authentication in Delta Electronics DIAEnergie before 1.11.00.022 allows authentication bypass, enabling remote attackers to reach protected functionality without valid credentials. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires no authentication, no user interaction, and no non-default configuration - only network reachability to the DIAEnergie service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); the practical exposure is limited chiefly by the product's footprint, as DIAEnergie is a niche ICS energy-management platform typically deployed on operational or enterprise networks rather than the public internet.
Delta UFC500 devices can be brute-forced through their HTTP basic authentication endpoint because the service enforces no retry limit or backoff and ships with a default service password, allowing an attacker positioned on an adjacent network segment to exhaust the keyspace and obtain low-sensitivity information. The CVSS 4.0 base score is 5.3 (medium), and the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N with only low confidentiality impact, so integrity and availability are unaffected and an on-segment network position is required. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the priority label is this_month.
An out-of-bounds memory write in the firmware of the Delta DVP-12SE11T programmable logic controller allows remote attackers to corrupt memory on a network-reachable device, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating no authentication or user interaction is required and full loss of confidentiality, integrity, and availability. The flaw is classified as CWE-787 (out-of-bounds write) and is reported against the DVP-12SE11T firmware with no version constraint in the CPE record, meaning all observed firmware builds of that model should be treated as affected until the vendor advisory (Delta PCSA-2025-00022) narrows the range. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; realistic exploitation depends on an attacker first reaching the controller on an OT/plant network segment, since the exact triggering protocol, port, or message type is not disclosed in the available data.
Denial of service in Delta Electronics DVP-12SE11T PLC firmware lets an unauthenticated, remote attacker crash or otherwise render the device unavailable (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N with availability-only impact). The vulnerability stems from improper input validation (CWE-20) in the device's exposed network service, and the CPE entry cpe:2.3:o:deltaww:dvp-12se11t_firmware:* indicates all observed firmware versions are affected. Risk is moderate rather than critical: EPSS is 0.32% (23rd percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and the practical barrier is network reachability - the device is normally deployed inside segmented or air-gapped OT networks, where no authentication or user interaction is required once the attacker can reach the service.
Authentication bypass in Delta DVP-12SE11T PLCs allows remote, unauthenticated attackers to fully compromise the controller’s confidentiality, integrity, and availability (CVSS 9.8). The flaw (CWE-288) leverages an alternate authentication path in the firmware, requiring network access to the device's engineering or communication interface and no user interaction. No public exploit identified at time of analysis; exploitation is primarily limited by OT network segmentation and firewalling.
Cleartext transmission in Delta DVP-12SE PLC firmware causes sensitive Modbus/TCP traffic - process values, register contents, and control commands - to cross the network unencrypted and unauthenticated, letting an attacker on the same Layer-2 segment eavesdrop on, inject into, or modify communications with the device. The CVSS 4.0 base score of 7.2 is driven by the adjacency requirement (AV:A) and the absence of any authentication or user interaction (PR:N/UI:N), with impact scored as low confidentiality and high integrity/availability loss against the PLC itself; subsequent-system metrics are all None, so the flaw does not chain outward to other assets. No public exploit code and no confirmed active exploitation were identified at time of analysis, and because exploitation demands a foothold on the OT/adjacent network rather than internet reachability, this is a moderate-priority ICS issue rather than an urgent internet-wide emergency.
Denial of service in Delta Electronics DVP15MC11T controllers can be triggered by malformed Modbus/TCP packets sent to the controller's unauthenticated port 502, causing availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms this is remotely reachable without authentication or user interaction, while confidentiality and integrity are not affected. No public exploit was identified at time of analysis, and EPSS is low at 0.22%, but exposure is highest where Modbus/TCP is reachable from untrusted networks rather than segmented OT networks.
A stack-based buffer overflow in Delta Electronics ASDA-Soft, the configuration utility for ASDA series servo drives, allows memory corruption when a local user opens a crafted project or configuration file. Affected are ASDA-Soft installations on engineering workstations (the CPE wildcard cpe:2.3:a:deltaww:asda_soft:*:*:*:*:*:*:*:* indicates all versions are in scope); exploitation requires the victim to actively open an attacker-supplied file and yields code execution in the context of the current user, with high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L/AC:L/PR:N/UI:R/S:U). No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.20% (9th percentile), though the reliance on file-delivery social engineering to operator workstations keeps the residual risk non-trivial in industrial environments.
Stack-based buffer overflow in Delta Electronics' ASDA-Soft servo commissioning software can be triggered when a user opens a maliciously crafted project or configuration file, allowing arbitrary code execution, data corruption, or a crash at the privilege level of the user running the application. Because exploitation requires local access and the victim to actively open an untrusted file (AV:L, UI:R, PR:N, CVSS 7.8), it is not remotely exploitable and depends on social engineering rather than a network-reachable service. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.20% (9th percentile), indicating low predicted real-world exploitation, though the small and typically isolated OT/engineering installation base also limits mass-scanning activity.
An issue was discovered in Delta Electronics WPLSoft, Versions prior to V2.42.11, ISPSoft, Versions prior to 3.02.11, and PMSoft, Versions prior to2.10.10. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Delta Electronics WPLSoft, Versions prior to V2.42.11, ISPSoft, Versions prior to 3.02.11, and PMSoft, Versions prior to 2.10.10. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.