Login Request a demo
High severity · published Oct 30, 2026
CVE-2026-22110
Missing authentication check on POST/PUT requests
New
8.7
CVSS
–
EPSS
No
On KEV
Description
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DU
Delta UFC500 · Delta Electronics
before 2.4.18; before 4.4.1 · source: vendor
Affected product
DU
Delta UFC500
Delta Electronics
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22110
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22110
third-party-advisory
https://csirt.divd.nl/DIVD-2026-00012
third-party-advisory
https://csirt.divd.nl/CVE-2026-22110
More from Delta UFC500
8.7
CVE-2026-22105
Use of default password based on serial number
8.4
CVE-2026-22109
Default WebUI passwords stored in plaintext
5.3
CVE-2026-22114
Missing brute-force protection for web interface