Veille CVE

Recherche « EVbee Service »

3 CVE

Critique 2 Élevée 0 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « EVbee Service » ✕
  1. CVE-2026-22101 5.1 Moyenne

    EVbee DC-80

    The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password.

  2. CVE-2026-22102 9.3 Critique

    EVbee DC-80

    A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service by overwriting system files, or remote-code-execution by overwriting shell-scripts which execution can be triggered through other means.

  3. CVE-2026-22093 9.5 Critique

    EVbee Service

    The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is weakly encrypted using RC4 with a hardcoded key, which allows an attacker to gain access to the communication. Part of this communication involves access codes to charging stations. This issue affects EVbee Service: v1.4.101.00.