High · 8.4 CVE-2026-22109 EUVD-2026-113763GHSA-pm3q-rpp8-c934

Default WebUI passwords stored in plaintext

Published Oct 30, 2026 · Updated Oct 30, 2026 · Assigned by DIVD

Vendor: Delta Electronics Product: Delta UFC500 Category: ICS / OT

Description

The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.

Affected products

Vendor	Product	Affected	Fixed
Delta Electronics	Delta UFC500	< 1.4.7	1.4.7

References

https://csirt.divd.nl/DIVD-2026-00012 third-party-advisory
https://csirt.divd.nl/CVE-2026-22109 third-party-advisory