CVE-2026-22105 in Delta UFC500
Summary
by MITRE • 10/30/2026
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Delta UFC500 charging stations represents a critical failure in credential management and authentication mechanisms, specifically affecting the Service account used for device configuration and maintenance. This flaw stems from an insecure algorithm that derives default passwords based on predictable patterns within the device's serial number rather than utilizing cryptographically secure random generation methods. By mapping specific character positions of the unique hardware identifier to password characters, the system creates a deterministic relationship between public or easily obtainable hardware information and private authentication credentials. This design choice fundamentally undermines the security model by allowing anyone with knowledge of the serial number to calculate the corresponding default password without requiring any prior authorization or interaction with the device's internal systems.
From an operational perspective, this vulnerability allows unauthenticated attackers who have adjacent network access to gain full administrative control over the charging station. The ability to reconstruct the password means that threat actors can bypass authentication entirely if they possess physical proximity to the unit or can obtain its serial number through other means such as visual inspection of the hardware label. Alternatively, even without knowing the exact derivation algorithm, an attacker could perform a brute-force attack against the limited keyspace generated by this flawed logic, which is significantly smaller and more predictable than standard random passwords. Once authenticated, the attacker gains access to sensitive configuration settings, most notably the Open Charge Point Protocol backend parameters. This level of control enables malicious actors to redirect charging sessions to fraudulent endpoints, steal user payment data, disrupt service availability, or use the device as a pivot point for further attacks against the broader network infrastructure.
This vulnerability aligns with CWE-798, which describes the use of hard-coded credentials derived from predictable sources, and falls under MITRE ATT&CK technique T1078, specifically relating to valid accounts used by attackers who have gained unauthorized access through weak or default authentication mechanisms. The impact extends beyond simple unauthorized access; it compromises the integrity and confidentiality of both the charging infrastructure and the users relying on it. Attackers can manipulate transaction logs, alter pricing structures, or exfiltrate personally identifiable information associated with user accounts linked to the station. Furthermore, because these devices are often deployed in public spaces, the risk is amplified by the ease with which an attacker might physically approach a unit to read its serial number before launching a remote network-based exploitation attempt.
Mitigation strategies must focus on immediate remediation of default credentials and long-term architectural improvements. Administrators should immediately change all default Service account passwords to strong, randomly generated strings that do not correlate with any device identifier or user information. It is also critical to disable the Service account if it is not actively required for ongoing maintenance operations, thereby reducing the attack surface. Network segmentation plays a vital role in limiting exposure; charging stations should be placed on isolated VLANs separate from corporate networks and public-facing services to prevent adjacent network access by potential attackers. Additionally, implementing strict firewall rules that restrict management interfaces to trusted IP addresses can provide an additional layer of defense. Manufacturers must address this flaw at the firmware level by replacing the deterministic password generation algorithm with a secure random number generator and ensuring that default credentials are unique per device or require immediate change upon first login through a forced reset process during initial setup.