CVE-2026-22105: Use of default password based on serial number
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set a non-default password for the Service account instead of the default password derived from the device serial number.
Delta UFC500 charging stations Service account password = Non-default password
Event History
Frequently Asked Questions
Which deployments are exposed?
Delta UFC500 charging stations are exposed when the Service account is still using credentials derived from the device serial number. An attacker must have adjacent network access to reach the affected station.
What does an attacker need to successfully access the Service account?
No prior authentication or user interaction is required. The attacker can reconstruct the password from character positions in the serial number or attempt the available keyspace.
What could an attacker change after gaining access?
The Service account can be used to read and modify sensitive settings, including the OCPP backend configuration.