EUVD-2026-43332Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Assuming logs are network-reachable per the source vector: unauthenticated low-complexity read (AV:N/AC:L/PR:N/UI:N) with high confidentiality and scope change (S:C) because exposed credentials/UIDs compromise other systems; no integrity or availability impact.
Primary rating from Vendor (DIVD).
CVSS VectorVendor: DIVD
Lifecycle Timeline
3DescriptionCVE.org
Various sensitive information such as passwords and charging card UIDs are written to log files.
AnalysisAI
Sensitive-data logging in the Evbee DC-80 DC EV charger writes secrets such as user passwords and charging card (RFID) UIDs in cleartext to log files, per DIVD advisory DIVD-2026-00001. The supplied CVSS 4.0 base score of 9.2 reflects high confidentiality impact to both the vulnerable system and downstream systems that reuse those credentials, so anyone able to read the logs can harvest reusable authentication material. No public exploit identified at time of analysis.
Technical ContextAI
The affected product is the Evbee DC-80, a DC fast-charging station (CPE cpe:2.3:a:evbee:dc-80). The root cause is CWE-532 (Insertion of Sensitive Information into Log File): the charger's software emits credentials and RFID card UIDs into diagnostic/operational logs rather than masking, hashing, or omitting them. Charging card UIDs function as authentication tokens for RFID-based access and billing, and passwords are direct account credentials, so recording either in logs turns routine log access into credential theft. The DIVD tags (Information Disclosure, Dc 80) confirm the class as disclosure rather than integrity or availability.
RemediationAI
No vendor-released patch version was identified at time of analysis; consult the DIVD advisory at https://csirt.divd.nl/DIVD-2026-00001/ for current fix status and apply the vendor's patched firmware once it is released. As compensating controls, place chargers on an isolated management VLAN and block their management/web ports at the perimeter so log files and any log-export interface are unreachable from untrusted networks (trade-off: may complicate remote operator monitoring); rotate all exposed passwords and re-issue or invalidate charging card UIDs that may have been logged, since exposed UIDs remain reusable until rotated; and where the device permits, disable verbose/debug logging and purge existing logs containing credentials (trade-off: reduced diagnostic capability). Because UIDs are static identifiers, add backend-side detection for reused or anomalous cards as a longer-term control.
Command injection in the evbee DC-80 EV charger allows remote unauthenticated attackers to execute arbitrary operating-s
Arbitrary code execution in the EVBEE DC-80 EV charging station stems from a firmware update mechanism that ships withou
Arbitrary file write in the Evbee DC-80 EV charging station lets remote unauthenticated attackers overwrite any file on
Missing authentication on the evbee DC-80 EV charging station exposes an administrative web server on TCP port 8090 that
Remote code execution in the evbee DC-80 EV charging station is possible through a command injection flaw in the network
Bluetooth authentication bypass in the Evbee DC-80 DC EV charging station lets an attacker within radio range issue priv
OS command injection in the EVBEE DC-80 electric-vehicle DC charger lets an actor who can send OCPP messages execute arb
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today