The shipped WebUI template database retains factory default passwords for all five account types in cleartext. Because the defaults are identical across devices and unchanged, an attacker can log in without authorization, gaining unauthorized access to the device and potentially the entire network. This falls under CWE‑1392 Sensitive Information Exposure.

All Delta Electronics Delta UFC500 devices are affected. Every firmware release of this model ships with the vulnerable WebUI configuration, so each unit possesses the default credentials that can be exploited.

The CVSS score of 8.4 signals a high‑severity vulnerability. While the EPSS score is not published, the absence of a KEV listing does not reduce the risk; an attacker with network visibility of the WebUI can trivially use the known default credentials. The likely attack path is a remote login via the exposed web interface, allowing the attacker to compromise the device’s confidentiality and integrity.