CVE-2026-22109 in Delta UFC500
Summary
by MITRE • 10/30/2026
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
This vulnerability represents a critical failure in secure configuration management, specifically falling under CWE-798: Use of Hard-coded Credentials. The issue stems from the WebUI template database retaining factory default passwords for all five distinct account types in cleartext format. This architectural decision means that sensitive authentication material is stored without any form of cryptographic protection or hashing, exposing it to immediate retrieval by any entity with access to the underlying storage medium or configuration files.
The severity of this flaw is compounded by the fact that these default credentials are identical across all devices of this model line and were confirmed unchanged on tested units. This uniformity creates a massive attack surface where a single compromised credential set can be used to gain unauthorized administrative access to any device within the affected product family, facilitating widespread automated attacks or lateral movement in networked environments. Attackers do not need to perform complex exploitation steps; they simply require read access to the template database to extract these static passwords and apply them directly against authentication endpoints.
From an operational impact perspective, this vulnerability effectively nullifies the principle of least privilege for administrative accounts. Since the default passwords are known globally and remain unmodified by default or during initial deployment, any attacker with network connectivity to the WebUI interface can authenticate as a privileged user without needing to guess credentials or exploit secondary vulnerabilities. This leads directly to CWE-287: Improper Authentication, allowing full control over device configuration, potential data exfiltration, and the ability to pivot into deeper internal networks if the device serves as a gateway or critical infrastructure component.
In terms of threat modeling, this aligns with MITRE ATT&CK technique T1078: Valid Accounts, where adversaries leverage legitimate credentials that are known or easily discoverable due to poor security hygiene by manufacturers. The cleartext storage further exacerbates the risk if an attacker gains file system access through a separate vector such as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, allowing them to harvest multiple account types simultaneously for different privilege levels within the application logic.
Mitigation strategies must prioritize immediate remediation at both the software and configuration layers. First, all instances of this device should be updated with firmware that implements secure credential storage practices, specifically using strong hashing algorithms such as bcrypt or Argon2 instead of cleartext storage, in compliance with CWE-916: Use of Password Hash With Insufficient Computational Effort if passwords are hashed but weakly. Second, during the initial setup process, devices must enforce mandatory password changes for all default account types before allowing any administrative actions, ensuring that static defaults are never used in production environments. Finally, network segmentation and strict access control lists should be applied to limit exposure of the WebUI interface to trusted management networks only, reducing the window of opportunity for remote exploitation until patches can be deployed.