Which versions of evbee DC-80 are affected by CVE-2026-22095?

The evbee DC-80 EV charging station contains a critical remote code execution vulnerability allowing unauthenticated attackers to fully compromise devices accessible on the network.. A patch is available.

How to fix or mitigate CVE-2026-22095?

Within 24 hours, identify all evbee DC-80 charging stations in your environment and configure firewall rules to isolate TCP port 8090 from untrusted networks; create a complete inventory documenting location, network access, and connectivity. Within 7 days, implement network segmentation restricting port 8090 access to authorized administrative networks only, deploy intrusion detection signatures for exploitation attempts, and disable remote access where operationally feasible. Within 30 days, establish a monitoring process for evbee security advisories to enable immediate deployment of patches when released; conduct security assessments of any affected devices to verify no unauthorized access occurred during the vulnerability window.

evbee DC-80 CVE-2026-22095

Q: What is the CVSS score of CVE-2026-22095?

CVE-2026-22095 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-43326 CRITICAL

Command Injection (CWE-77)

2026-07-13 DIVD

Command Injection Dc 80 Evbee

9.3

CVSS 4.0 · Vendor: DIVD

Severity by source

Vendor (DIVD) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, unauthenticated, low-complexity command injection on a network-reachable endpoint yields full device C/I/A loss; scope unchanged as the impact stays within the vulnerable firmware.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (DIVD).

CVSS VectorVendor: DIVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 13, 2026 - 12:01 EUVD

Analysis Generated

Jul 13, 2026 - 11:13 vuln.today

CVE Published

Jul 13, 2026 - 09:10 cve.org

CRITICAL 9.3

DescriptionCVE.org

The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.

AnalysisAI

Remote code execution in the evbee DC-80 EV charging station is possible through a command injection flaw in the network diagnosis endpoint exposed on the web server at TCP port 8090. Because the CVSS 4.0 vector specifies no privileges and no user interaction (AV:N/PR:N/UI:N), a remote unauthenticated attacker who can reach port 8090 can inject operating-system commands and fully compromise the device. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the DIVD coordinated disclosure and 9.3 (Critical) score make it a high-priority defect.

Technical ContextAI

The affected product is the evbee DC-80, an EV charging station (CPE cpe:2.3:a:evbee:dc-80), whose embedded firmware runs a management/diagnostic web service on port 8090. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning user-supplied input to the network-diagnosis feature (typically ping/traceroute-style connectivity tests) is passed into a system shell without adequate sanitization. In embedded IoT and OT devices like EV chargers, such diagnostic helpers commonly invoke underlying OS binaries (e.g. ping) via a shell, so injected metacharacters (;, |, &&, backticks, $()) execute additional attacker-controlled commands, frequently with elevated or root privileges typical of firmware web daemons.

RemediationAI

No vendor-released patch identified at time of analysis, so remediation currently centers on exposure reduction: consult the DIVD advisory at https://csirt.divd.nl/DIVD-2026-00001/ for the latest vendor status and apply any evbee firmware update as soon as one is published. As compensating controls, block or firewall inbound access to TCP port 8090 so it is not reachable from untrusted networks or the internet (side effect: legitimate remote diagnostics/management over that port will break); place the charger on an isolated VLAN or management network with strict ACLs allowing only trusted operator hosts to reach it; and if the network-diagnosis feature is not required, disable it where the device configuration allows (side effect: loss of built-in connectivity troubleshooting). Monitor the device and upstream firewall logs for unexpected requests to port 8090 as a detection measure.