{"id":"CVE-2026-22109","aliases":[],"cve":{"records":[{"id":"CVE-2026-22109","source":"DIVD","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-01-06T11:08:58.186Z","published":"2026-10-30T10:34:21.978Z","modified":"2026-10-30T16:34:28.556Z"}],"publishers":[{"name":"DIVD","role":"CNA","organizationId":"b87402ff-ae37-4194-9dae-31abdbd6f217","modified":"2026-10-30T10:34:21.978Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T16:34:28.556Z"}],"references":[{"url":"https://csirt.divd.nl/DIVD-2026-00012","tags":["third-party-advisory"],"source":"DIVD"},{"url":"https://csirt.divd.nl/CVE-2026-22109","tags":["third-party-advisory"],"source":"DIVD"}],"weaknesses":[{"id":"CWE-1392","description":"CWE-1392 Use of default credentials","source":"DIVD"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:34:13.914631Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Default WebUI passwords stored in plaintext","titleSource":"DIVD","descriptionSource":"DIVD","description":"The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.","score":8.4,"severity":"high","published":"2026-10-30T10:34:21.978Z","modified":"2026-10-30T16:34:28.556Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Delta Electronics","name":"Delta UFC500","platforms":[],"versions":[{"version":"2.4.18","status":"unknown"}],"defaultStatus":"unknown","cpes":[],"source":"DIVD","url":"https://www.cve.org/CVERecord?id=CVE-2026-22109"},{"vendor":"Delta Electronics","name":"Delta UFC500","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.4.7","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"DIVD","url":"https://www.cve.org/CVERecord?id=CVE-2026-22109"}],"remediation":[{"text":"Update to the latest version.","source":"DIVD","url":"https://www.cve.org/CVERecord?id=CVE-2026-22109"},{"text":"Change the default password for each account to a unique, non-default password.","source":"DIVD","url":"https://www.cve.org/CVERecord?id=CVE-2026-22109"}],"references":["https://csirt.divd.nl/DIVD-2026-00012","https://csirt.divd.nl/CVE-2026-22109"],"sources":[{"name":"CVE","id":"CVE-2026-22109","modified":"2026-10-30T16:34:28.556Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-22109"}],"assessments":[{"source":"DIVD","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:H/SA:L","score":8.4}],"sourceAffected":[],"observedAt":"2026-10-30T17:32:25.512Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:40:33.739Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T10:50:34.975Z","attemptedAt":"2026-10-30T10:50:34.975Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T10:50:34.989Z","attemptedAt":"2026-10-30T10:50:34.989Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T10:50:35.431Z","attemptedAt":"2026-10-30T10:50:35.431Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T10:50:34.980Z","attemptedAt":"2026-10-30T10:50:34.980Z"}],"evidence":[],"aiSummary":{"text":"Delta Electronics' Delta UFC500 versions less than 1.4.7 store default WebUI passwords in plaintext. An attacker with access to the device may obtain these default credentials. The impact is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T12:51:26.282Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-22109"}]}}