CVE-2026-22105

The record

Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.

Affected packages

Related vulnerabilities

• CVE-2026-22109 The shipped WebUI template database retains the factory default passwords for all five… CWE-1392
• CVE-2026-19741 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default… CWE-1392
• CVE-2026-55457 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-1392
• CVE-2026-112296 FlyCms through commit edfdf724 contains a default credentials vulnerability that allows… CWE-1392
• CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials… CWE-1392
• CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1392
• CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering… CWE-1392
• CVE-2026-68503 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. CWE-1392