Delta UFC500 charging stations generate default Service account credentials derived from character positions of the device serial number. This flaw enables an unauthenticated attacker to reconstruct or brute‑force the password, thereby obtaining read and write access to sensitive configuration such as the OCPP backend. The weakness stems from improper handling of default credentials (CWE‑1392).

Delta Electronics’ Delta UFC500 charging stations are affected; no specific firmware or model version details are provided in the publicly available information.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that an attacker would need adjacent network access to communicate with the device, then exploit the predictable credential derivation. Once authenticated, the attacker can alter settings that control charging operations, potentially compromising service availability and financial systems.