Which versions of Dc 80 are affected by CVE-2026-22096?

The evbee DC-80 EV charging station contains a critical authentication bypass that exposes its administrative web server to unauthenticated remote access, enabling attackers to steal configured…. A patch is available.

How to fix or mitigate CVE-2026-22096?

Within 24 hours: Immediately isolate all evbee DC-80 charging stations from internet-facing network segments and block inbound access to TCP port 8090 at the firewall perimeter; document all affected assets. Within 7 days: Rotate administrative credentials on all units; implement network segmentation to restrict TCP 8090 access only to dedicated secure maintenance networks; review access logs for signs of unauthorized access or reconnaissance. Within 30 days: Monitor CVE-2026-22096 and DIVD-2026-00001 advisories for patch release from evbee; establish a controlled testing environment for firmware validation; develop a prioritized upgrade plan that addresses internet-facing and high-traffic charging stations first once patches are available.

Dc 80 CVE-2026-22096

Q: What is the CVSS score of CVE-2026-22096?

CVE-2026-22096 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43328 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-13 DIVD

Authentication Bypass Dc 80 Evbee

9.3

CVSS 4.0 · Vendor: DIVD

Severity by source

Vendor (DIVD) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (DIVD) · only source for this CVE.

CVSS VectorVendor: DIVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 13, 2026 - 12:01 EUVD

Analysis Generated

Jul 13, 2026 - 11:11 vuln.today

CVE Published

Jul 13, 2026 - 09:10 cve.org

CRITICAL 9.3

DescriptionCVE.org

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.

AnalysisAI

Missing authentication on the evbee DC-80 EV charging station exposes an administrative web server on TCP port 8090 that requires no login, allowing remote unauthenticated attackers to read sensitive data such as configured passwords and to upload arbitrary files via multiple endpoints. Reported through the DIVD CSIRT coordinated-disclosure program (DIVD-2026-00001), the flaw carries a CVSS 4.0 base score of 9.3 with a fully network-exploitable, no-privilege vector. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.