CVE-2026-22110 in Delta UFC500
Summary
by MITRE • 10/30/2026
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
This vulnerability represents a critical failure in access control mechanisms within the web server interface of an electric vehicle charging station. The core technical flaw lies in the absence of authentication checks for HTTP POST and PUT requests, which are typically used to modify device configurations or execute administrative commands. In standard secure implementations, any request intended to alter state or settings must be preceded by a valid session token or credential verification. However, in this specific implementation, the server processes these modification requests without validating whether the requester has been authenticated. This oversight allows an unauthenticated actor on the same network segment to interact directly with administrative endpoints that should remain restricted to authorized personnel only.
The operational impact of this flaw is severe and multifaceted. Initially, an attacker can exploit the lack of authentication to send a reboot command to the charger. While a simple reboot might seem like a minor inconvenience, it effectively results in a denial-of-service condition for any users attempting to charge their vehicles at that specific unit. More critically, the vulnerability extends beyond mere disruption. By leveraging the same unauthenticated POST or PUT capabilities, an attacker can brute-force the configuration ID, which serves as a unique identifier for device settings. Once this identifier is obtained through automated guessing due to its potentially low entropy or predictable structure, the attacker gains the ability to modify critical system parameters.
The most dangerous consequence arises when the attacker uses these privileges to set or change the service password. By altering the administrative credentials, the attacker establishes persistent access to the device's management interface. This allows them to subsequently change any setting on the charger, potentially disabling safety features, redirecting charging sessions for financial fraud, or further compromising the network infrastructure if the charger is connected to a larger corporate or public grid system. The combination of unauthenticated command execution and weak configuration ID security creates a pathway for complete device compromise without requiring physical access or prior authentication credentials.
From a classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as the system fails to verify identity before granting administrative privileges. It also relates closely to CWE-601, URL Redirection to Untrusted Site, if the configuration changes involve redirecting traffic or services, and generally falls under CWE-352, Cross-Site Request Forgery (CSRF), although in this case, it is a direct API vulnerability rather than just browser-based forgery. In terms of adversary tactics, this maps to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker creates or modifies credentials for unauthorized access, and T1499, Endpoint Denial of Service, via the reboot capability.
To mitigate these risks, immediate remediation is required at both the application logic and network architecture levels. The primary fix involves implementing strict authentication checks on all POST and PUT endpoints within the web server's API layer. Every administrative request must require a valid session token or cryptographic signature that verifies the user's identity before any state-changing operation is executed. Additionally, the configuration ID should be replaced with a high-entropy random identifier to prevent brute-force attacks from succeeding in reasonable timeframes. Network segmentation strategies should also be employed to ensure that management interfaces are not accessible from untrusted networks, restricting access only to authorized administrative subnets or virtual private networks. Regular security audits and penetration testing focused on API authentication flows will help identify similar oversights before they can be exploited in production environments.