high8.7
CVE-2026-22110
The web server does not check authentication on POST or PUT.
Impact
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Delta Electronics | Delta UFC500 | before 2.4.18 before 4.4.1 |