Veille CVE

Recherche « EVbee DC 80 »

10 CVE

Critique 7 Élevée 2 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « EVbee DC 80 » ✕
  1. CVE-2026-22101 5.1 Moyenne

    EVbee DC-80

    The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password.

  2. CVE-2026-22094 9.3 Critique

    EVbee DC 80

    The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.

  3. CVE-2026-22103 9.3 Critique

    EVbee DC-80

    The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.

  4. CVE-2026-22102 9.3 Critique

    EVbee DC-80

    A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service by overwriting system files, or remote-code-execution by overwriting shell-scripts which execution can be triggered through other means.

  5. CVE-2026-22100 8.6 Élevée

    EVbee DC-80

    The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root.

  6. CVE-2026-22099 8.7 Élevée

    EVbee DC-80

    The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering reboots, or pushing a firmware update URL.

  7. CVE-2026-22098 9.2 Critique

    EVbee DC-80

    Various sensitive information such as passwords and charging card UIDs are written to log files.

  8. CVE-2026-22097 9.3 Critique

    EVbee DC-80

    The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.

  9. CVE-2026-22096 9.3 Critique

    EVbee DC-80

    The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.

  10. CVE-2026-22095 9.3 Critique

    EVbee DC-80

    The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.