{"id":"CVE-2026-22110","aliases":[],"cve":{"records":[{"id":"CVE-2026-22110","source":"DIVD","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-01-06T11:08:58.186Z","published":"2026-10-30T10:34:24.151Z","modified":"2026-10-30T16:35:40.502Z"}],"publishers":[{"name":"DIVD","role":"CNA","organizationId":"b87402ff-ae37-4194-9dae-31abdbd6f217","modified":"2026-10-30T10:34:24.151Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T16:35:40.502Z"}],"references":[{"url":"https://csirt.divd.nl/DIVD-2026-00012","tags":["third-party-advisory"],"source":"DIVD"},{"url":"https://csirt.divd.nl/CVE-2026-22110","tags":["third-party-advisory"],"source":"DIVD"}],"weaknesses":[{"id":"CWE-306","description":"CWE-306 Missing authentication for critical function","source":"DIVD"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:35:22.976391Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Missing authentication check on POST/PUT requests","titleSource":"DIVD","descriptionSource":"DIVD","description":"The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.","score":8.7,"severity":"high","published":"2026-10-30T10:34:24.151Z","modified":"2026-10-30T16:35:40.502Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Delta Electronics","name":"Delta UFC500","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2.4.18","versionType":"semver"},{"version":"2.4.18","status":"unaffected"}],"defaultStatus":"unknown","cpes":[],"source":"DIVD","url":"https://www.cve.org/CVERecord?id=CVE-2026-22110"},{"vendor":"Delta Electronics","name":"Delta UFC500","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"4.4.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"DIVD","url":"https://www.cve.org/CVERecord?id=CVE-2026-22110"}],"remediation":[{"text":"Update to the latest version.","source":"DIVD","url":"https://www.cve.org/CVERecord?id=CVE-2026-22110"}],"references":["https://csirt.divd.nl/DIVD-2026-00012","https://csirt.divd.nl/CVE-2026-22110"],"sources":[{"name":"CVE","id":"CVE-2026-22110","modified":"2026-10-30T16:35:40.502Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-22110"}],"assessments":[{"source":"DIVD","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","score":8.7}],"sourceAffected":[],"observedAt":"2026-10-30T17:32:27.255Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T03:10:30.875Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T10:50:31.619Z","attemptedAt":"2026-10-30T10:50:31.619Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T10:50:32.537Z","attemptedAt":"2026-10-30T10:50:32.537Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T10:50:32.537Z","attemptedAt":"2026-10-30T10:50:32.537Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T10:50:32.120Z","attemptedAt":"2026-10-30T10:50:32.120Z"}],"evidence":[],"aiSummary":{"text":"Delta Electronics' Delta UFC500 versions less than 2.4.18 and less than 4.4.1 have a missing authentication check on POST/PUT requests, allowing an unauthenticated attacker to reboot the charger or change settings. The attacker must have access to the web server. The impact includes setting the service password and changing any setting.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T10:51:05.261Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-22110"}]}}