{"id":"CVE-2026-22114","title":"Missing brute-force protection for web interface","summary":"HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.","severity":"medium","cvss":5.3,"cvssVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-307"],"vendor":"Delta Electronics","product":"msi-image","affected":["msi-image","ECP < 4.4.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T16:33:36.327503Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T16:33:58.275Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-22114","references":[{"url":"https://csirt.divd.nl/DIVD-2026-00012"},{"url":"https://csirt.divd.nl/CVE-2026-22114"}],"tags":["cve.org"],"epss":0.00185,"epssPercentile":0.08144,"ingestedAt":"2026-11-05T16:24:31.077Z","slug":"CVE-2026-22114","body":"## Overview\n\nHTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.\n\n## Affected\n\n- `msi-image`\n- `ECP < 4.4.2`\n\n## Remediation\n\nUpdate to the latest version.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}