Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-22101

Sensitive information leak through hidden menu

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22094

Weak root password in EVbee DC 80

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22095

Command injection in diagnosis web endpoint

The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22100

Comnand injection in OCPP ReserveLogin message

The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root.

CVSS 4.0 · 8.6 High EPSS 1.1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22096

Missing authentication for webserver endpoints

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22102

Arbitrary file overwrite through certificate update functionality

A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service by overwriting system files, or remote-code-execution by overwriting shell-scripts which execution can be triggered through other means.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22099

Missing authentication for Bluetooth communication

The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering reboots, or pushing a firmware update URL.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22097

Missing firmware validation allows remote code execution

The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22098

Sensitive information is written to logs

Various sensitive information such as passwords and charging card UIDs are written to log files.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22103

Command injection in NPC start web endpoint

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed
Vendors
Evbee
Products
Dc-80