Which versions of Evbee Service are affected by CVE-2026-22093?

EVbee Service Android app v1.4.101.00 fails to validate TLS certificates and uses hardcoded RC4 encryption, enabling attackers on the network path to intercept, decrypt, and manipulate…. A patch is available.

How to fix or mitigate CVE-2026-22093?

Within 24 hours: issue a security advisory to all EVbee Service users recommending they avoid public WiFi and unsecured networks, and enable network monitoring for suspicious connection attempts to EVbee infrastructure. Within 7 days: conduct a risk assessment to identify high-value targets (fleet operators) and prioritize notification; evaluate interim controls such as VPN-only deployment for corporate fleets. Within 30 days: coordinate with vendor on patch timeline; if no vendor patch is forthcoming, develop a migration plan to alternative charging applications or prepare for app replacement with certificate pinning and upgraded encryption.

Evbee Service CVE-2026-22093

Q: What is the CVSS score of CVE-2026-22093?

CVE-2026-22093 has a CVSS 4.0 base score of 9.5 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43325 CRITICAL

Improper Certificate Validation (CWE-295)

2026-07-13 DIVD

Information Disclosure Google Evbee Service Evbee

9.5

CVSS 4.0 · Vendor: DIVD

Severity by source

Vendor (DIVD) PRIMARY

9.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (DIVD) · only source for this CVE.

CVSS VectorVendor: DIVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 13, 2026 - 12:01 EUVD

Analysis Generated

Jul 13, 2026 - 11:13 vuln.today

CVE Published

Jul 13, 2026 - 09:10 cve.org

CRITICAL 9.5

DescriptionCVE.org

The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is weakly encrypted using RC4 with a hardcoded key, which allows an attacker to gain access to the communication. Part of this communication involves access codes to charging stations.

This issue affects EVbee Service: v1.4.101.00.

AnalysisAI

Man-in-the-middle interception and traffic manipulation in the EVbee Service Android app (v1.4.101.00) is possible because the app negotiates HTTPS but never validates the server's TLS certificate, and further protects payloads only with RC4 under a hardcoded key. An attacker positioned on the network path can decrypt and alter app-to-server traffic and harvest charging-station access codes. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is trivially reproducible with standard interception tooling.