Delta Ufc500
Monthly
Delta UFC500 chargers expose web server POST and PUT actions without authentication, allowing an attacker on the adjacent network to reboot the device and, if the configid can be brute-forced, set the service password and alter arbitrary settings. The flaw is a CWE-306 missing-authentication issue rated CVSS 8.7, with high confidentiality and integrity impact and lower availability impact; the independent assessment notes that network segmentation or isolating the charger management interface materially reduces realistic exposure. No public exploit identified at time of analysis, and the vuln.today decision label is this_week.
Delta UFC500 charging stations generate the Service-account password from fixed character positions of the device serial number, so anyone who can reach the charger's management interface on an adjacent network segment can reconstruct that password - or brute-force the small resulting keyspace - and log in without credentials. Successful login gives read and write access to sensitive configuration, including the OCPP backend the station connects to, so an attacker could redirect charging traffic or alter operational settings. The access vector is adjacent/local, not internet-wide remote, so exposure depends on whether the management plane is reachable from a shared site LAN, management VLAN or local wireless; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though DIVD rates it a this-week operational priority.
Cleartext storage of universal factory default passwords in the Delta UFC500 WebUI template database lets an authenticated attacker with low local privileges recover credentials for all five account types. The defaults are identical across devices and were unchanged on the tested unit, so recovered credentials can be reused on any unit where operators have not rotated them; the sources do not confirm whether those defaults are usable for network-facing WebUI login. No public exploit identified at time of analysis, and the priority label is this_week rather than an emergency or KEV-confirmed active-exploitation signal.
Delta UFC500 devices can be brute-forced through their HTTP basic authentication endpoint because the service enforces no retry limit or backoff and ships with a default service password, allowing an attacker positioned on an adjacent network segment to exhaust the keyspace and obtain low-sensitivity information. The CVSS 4.0 base score is 5.3 (medium), and the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N with only low confidentiality impact, so integrity and availability are unaffected and an on-segment network position is required. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the priority label is this_month.
Delta UFC500 chargers expose web server POST and PUT actions without authentication, allowing an attacker on the adjacent network to reboot the device and, if the configid can be brute-forced, set the service password and alter arbitrary settings. The flaw is a CWE-306 missing-authentication issue rated CVSS 8.7, with high confidentiality and integrity impact and lower availability impact; the independent assessment notes that network segmentation or isolating the charger management interface materially reduces realistic exposure. No public exploit identified at time of analysis, and the vuln.today decision label is this_week.
Delta UFC500 charging stations generate the Service-account password from fixed character positions of the device serial number, so anyone who can reach the charger's management interface on an adjacent network segment can reconstruct that password - or brute-force the small resulting keyspace - and log in without credentials. Successful login gives read and write access to sensitive configuration, including the OCPP backend the station connects to, so an attacker could redirect charging traffic or alter operational settings. The access vector is adjacent/local, not internet-wide remote, so exposure depends on whether the management plane is reachable from a shared site LAN, management VLAN or local wireless; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though DIVD rates it a this-week operational priority.
Cleartext storage of universal factory default passwords in the Delta UFC500 WebUI template database lets an authenticated attacker with low local privileges recover credentials for all five account types. The defaults are identical across devices and were unchanged on the tested unit, so recovered credentials can be reused on any unit where operators have not rotated them; the sources do not confirm whether those defaults are usable for network-facing WebUI login. No public exploit identified at time of analysis, and the priority label is this_week rather than an emergency or KEV-confirmed active-exploitation signal.
Delta UFC500 devices can be brute-forced through their HTTP basic authentication endpoint because the service enforces no retry limit or backoff and ships with a default service password, allowing an attacker positioned on an adjacent network segment to exhaust the keyspace and obtain low-sensitivity information. The CVSS 4.0 base score is 5.3 (medium), and the assessed CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N with only low confidentiality impact, so integrity and availability are unaffected and an on-segment network position is required. No public exploit code or confirmed active exploitation was identified in the available intelligence, and the priority label is this_month.