An HTTP basic authentication interface on the Delta UFC500 web interface has no retry limit or backoff, allowing an attacker to exhaust the small keyspace defined by the default service password. This weakness, classified as CWE-307, lets an adversary gain unauthorized administrative access by brute‑forcing login credentials, potentially compromising device configuration and control.

The vulnerability affects Delta Electronics Delta UFC500 devices. No specific firmware or version information was provided in the data, so all versions currently running the insecure web interface are considered at risk.

The CVSS score of 5.3 indicates a moderate severity, while the lack of an EPSS score and the absence of a KEV listing suggest that public exploitation is not yet widespread. Nonetheless, the absence of retry limits means the attack is technically feasible with minimal effort, especially since the default password is widely known and easily guessable. The risk remains primarily real for devices exposed on managed networks or the Internet where an attacker can target the web interface directly.