The Delta UFC500 web server fails to enforce authentication for POST and PUT requests. An attacker who can reach the device via its web interface can send unauthenticated POST or PUT messages, causing the charger to reboot or, by brute‑forcing the configuration identifier, assign a new service password and alter any configuration setting. This results in denial of service from uncontrolled reboots and enables unauthorized configuration changes that could compromise device operation.

Delta Electronics Delta UFC500 charging units. No specific firmware version was supplied, so all iterations of this product may be affected until the vendor issues a corrected build.

The vulnerability has a CVSS score of 8.7, indicating high severity. No EPSS score is reported and it is not catalogued in the CISA KEV list. The most likely attack vector is over the local network to the device’s web interface; any host that can reach the device could exploit the flaw without authentication, so the exploitation probability depends on network exposure.