EVBEE DC-80 CVE-2026-22097

Exploitation requires network reachability to the EVBEE DC-80 firmware update capability and the ability to submit a firmware image to it; the missing cryptographic signature validation means no valid vendor signing key is needed for the image to be accepted. The 'Jwt Attack' tag indicates the update interface is protected by JWT-based authorization, so exploitation in practice depends on either holding valid access to the update function or forging/bypassing that JWT - the official vector rates this PR:N, implying that authorization barrier is considered weak or bypassable, but this should be verified against the specific deployment. Exploitation is limited by whether the update/management interface is exposed beyond a trusted network: a DC-80 whose update endpoint is confined to an isolated management segment is not reachable by an unauthenticated internet attacker despite the network-vector rating.

The signals point to a genuinely high-priority issue. The DIVD-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H with subsequent-system SC:L/SI:L/SA:L, score 9.3) indicates network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity and availability impact plus some spillover to connected systems. That said, the description qualifies exploitation as available to 'anyone with access to the firmware update capability,' which is in mild tension with PR:N - the PR:N rating appears to rely on the JWT-based authorization being weak or bypassable rather than the endpoint being wholly open, so defenders should verify whether the update interface is exposed and whether a JWT weakness truly removes the auth barrier. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automated exploitation yet; real-world risk is currently driven by the severity of impact rather than confirmed in-the-wild activity, and is bounded by how many DC-80 units expose the update interface to untrusted networks.

An attacker who can reach the DC-80's network-exposed firmware update interface - potentially after abusing a JWT authorization weakness to gain access - uploads a crafted firmware image containing a malicious payload. Because the updater performs no signature verification, the device installs and runs the attacker's code, yielding full control of the charger and a foothold to affect connected charging or management systems. No public exploit is identified at time of analysis, so an attacker would need to weaponize the flaw themselves.