{"id":"CVE-2026-22114","aliases":[],"cve":{"records":[{"id":"CVE-2026-22114","source":"DIVD","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-01-06T11:08:58.186Z","published":"2026-10-30T10:34:20.904Z","modified":"2026-10-30T16:33:58.275Z"}],"publishers":[{"name":"DIVD","role":"CNA","organizationId":"b87402ff-ae37-4194-9dae-31abdbd6f217","modified":"2026-10-30T10:34:20.904Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T16:33:58.275Z"}],"references":[{"url":"https://csirt.divd.nl/DIVD-2026-00012","tags":["third-party-advisory"],"source":"DIVD"},{"url":"https://csirt.divd.nl/CVE-2026-22114","tags":["third-party-advisory"],"source":"DIVD"}],"weaknesses":[{"id":"CWE-307","description":"CWE-307 Improper restriction of excessive authentication attempts","source":"DIVD"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T16:33:36.327503Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Missing brute-force protection for web interface","titleSource":"DIVD","descriptionSource":"DIVD","description":"HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.","score":5.3,"severity":"medium","published":"2026-10-30T10:34:20.904Z","modified":"2026-10-30T16:33:58.275Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Delta Electronics","name":"Delta UFC500","platforms":[],"versions":[{"version":"2.4.18","status":"unknown"}],"defaultStatus":"unknown","cpes":[],"source":"DIVD","url":"https://www.cve.org/CVERecord?id=CVE-2026-22114"},{"vendor":"Delta Electronics","name":"Delta UFC500","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"4.4.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"DIVD","url":"https://www.cve.org/CVERecord?id=CVE-2026-22114"}],"remediation":[{"text":"Update to the latest version.","source":"DIVD","url":"https://www.cve.org/CVERecord?id=CVE-2026-22114"}],"references":["https://csirt.divd.nl/DIVD-2026-00012","https://csirt.divd.nl/CVE-2026-22114"],"sources":[{"name":"CVE","id":"CVE-2026-22114","modified":"2026-10-30T16:33:58.275Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-22114"}],"assessments":[{"source":"DIVD","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-30T17:32:29.102Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T10:50:35.850Z","attemptedAt":"2026-10-30T10:50:35.850Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T10:50:35.858Z","attemptedAt":"2026-10-30T10:50:35.858Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T10:50:36.365Z","attemptedAt":"2026-10-30T10:50:36.365Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T10:50:35.900Z","attemptedAt":"2026-10-30T10:50:35.900Z"}],"evidence":[],"aiSummary":{"text":"Delta Electronics' Delta UFC500 versions 0 to 4.4.2 and possibly 2.4.18 have a missing brute-force protection for the web interface, allowing exhaustive key space attacks due to no retry limit or backoff in HTTP basic auth. The default service password increases vulnerability. Local access may be required.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T10:51:12.728Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-22114"}]}}