EUVD-2026-113762: No login retry limit in Delta UFC500 HTTP basic auth
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Delta Electronics
- Product
- Delta UFC500
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-113762 (CVSS 5.3) reports that HTTP basic authentication on the Delta UFC500 enforces no retry limit or backoff. Combined with a default service password, the entry says the keyspace is exhaustible.
If you use Delta Electronics
Change the default service password on every UFC500 unit
Restrict access to the device's web interface to trusted networks
Check Delta Electronics for a firmware update that adds rate limiting
Change all five default account passwords on every UFC500 unit now
Ask Delta Electronics for a firmware fix that removes the cleartext defaults
Change the Service account password on every UFC500 unit
What the sources say 4
· Mastodon: “The web server does not check authentication on POST or PUT.” Source
· Mastodon: “Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number.” Source
· Mastodon: “The shipped WebUI template database retains the factory default passwords for all five account types in cleartext.” Source
· Mastodon: “HTTP basic auth enforces no retry limit or backoff.” Source