Which versions of EVBEE DC-80 are affected by CVE-2026-22097?

The EVBEE DC-80 EV charging station contains a critical vulnerability that allows attackers to install and execute malicious firmware, achieving complete device compromise; no public exploit code is…. A patch is available.

How to fix or mitigate CVE-2026-22097?

Within 24 hours: conduct an asset inventory to identify all EVBEE DC-80 chargers deployed in your environment and document their network locations and operational criticality. Within 7 days: implement network segmentation to restrict access to update functionality, disable remote firmware update capabilities where operationally feasible, require manual authorization for any update attempts, and enable comprehensive logging of all update-related activities. Within 30 days: establish active monitoring of DIVD advisory DIVD-2026-00001 and vendor communications; prepare and test a rapid patch deployment procedure for immediate implementation upon vendor release.

EVBEE DC-80 CVE-2026-22097

Q: What is the CVSS score of CVE-2026-22097?

CVE-2026-22097 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43331 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-13 DIVD

RCE Jwt Attack Dc 80

9.3

CVSS 4.0 · Vendor: DIVD

Severity by source

Vendor (DIVD) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Network-reachable updater with no signature check and JWT-bypassable authorization gives AV:N/AC:L/PR:N; unsigned firmware install yields full C:H/I:H/A:H, and code execution reaching connected charging systems supports S:C.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (DIVD).

CVSS VectorVendor: DIVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 13, 2026 - 12:01 EUVD

Analysis Generated

Jul 13, 2026 - 11:11 vuln.today

CVE Published

Jul 13, 2026 - 09:10 cve.org

CRITICAL 9.3

DescriptionCVE.org

The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.

AnalysisAI

Arbitrary code execution in the EVBEE DC-80 EV charging station stems from a firmware update mechanism that ships without cryptographic signature validation (CWE-347), letting an attacker who reaches the update capability push a malicious firmware image and have it executed by the device. Reported by DIVD (advisory DIVD-2026-00001) with a CVSS 4.0 base score of 9.3 and a 'Jwt Attack' angle noted in triage tags, the flaw grants full compromise of the charger. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the firmware update pathway of the EVBEE DC-80, a network-reachable DC electric-vehicle charging unit (CPE cpe:2.3:a:evbee:dc-80). The root cause is CWE-347 (Improper Verification of Cryptographic Signature): the updater accepts and installs firmware images without verifying an authenticity/integrity signature, so it cannot distinguish vendor-signed firmware from attacker-supplied files. Combined with the 'Jwt Attack' tag, this suggests the update endpoint's authorization is JWT-based and may be forgeable or bypassable, allowing an attacker to reach an interface that then trusts any uploaded binary. Because uploaded firmware runs with the device's own privileges after installation, an unsigned upload converts directly into arbitrary code execution on the embedded controller.

RemediationAI

No vendor-released patch or fixed firmware version is identified in the provided data, so remediation should center on compensating controls until the vendor publishes signed firmware: place DC-80 chargers on an isolated management VLAN and block inbound access to the firmware update / management interface from untrusted networks and the internet, restricting it to a trusted administrative host or VPN (trade-off: legitimate remote firmware pushes must then originate from that controlled path). Because the 'Jwt Attack' tag implicates the authorization layer, rotate or invalidate any static or predictable JWT signing secrets and enforce short token lifetimes if configurable, and monitor the update endpoint for unexpected upload attempts. Track DIVD advisory DIVD-2026-00001 (https://csirt.divd.nl/DIVD-2026-00001/) for the official fix and, once available, upgrade to the vendor's signed-firmware release. Note that network isolation is the most reliable operator-side mitigation here, since the underlying missing-signature-check flaw cannot be closed without vendor firmware.