CWE-306 (Missing Authentication for Critical Function)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Delta Electronics
Delta UFC500
Subsystems
General OT
Sectors
Multiple
What to Know
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting. (NVD)
What to Do
Monitor Delta Electronics's web page for any future patch releases.