Skip to main content

Evbee DC-80 CVE-2026-22098

| EUVDEUVD-2026-43332 CRITICAL
Insertion of Sensitive Information into Log File (CWE-532)
2026-07-13 DIVD
Information Disclosure Dc 80
9.2
CVSS 4.0 · Vendor: DIVD
Share

Severity by source

Vendor (DIVD) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.6 HIGH

Assuming logs are network-reachable per the source vector: unauthenticated low-complexity read (AV:N/AC:L/PR:N/UI:N) with high confidentiality and scope change (S:C) because exposed credentials/UIDs compromise other systems; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (DIVD).

CVSS VectorVendor: DIVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 13, 2026 - 12:01 EUVD
Analysis Generated
Jul 13, 2026 - 11:11 vuln.today
CVE Published
Jul 13, 2026 - 09:10 cve.org
CRITICAL 9.2

DescriptionCVE.org

Various sensitive information such as passwords and charging card UIDs are written to log files.

AnalysisAI

Sensitive-data logging in the Evbee DC-80 DC EV charger writes secrets such as user passwords and charging card (RFID) UIDs in cleartext to log files, per DIVD advisory DIVD-2026-00001. The supplied CVSS 4.0 base score of 9.2 reflects high confidentiality impact to both the vulnerable system and downstream systems that reuse those credentials, so anyone able to read the logs can harvest reusable authentication material. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach exposed charger log interface
Delivery
Retrieve Evbee DC-80 log files
Exploit
Extract plaintext passwords and card UIDs
Execution
Replay credentials/UIDs to authenticate
Impact
Obtain unauthorized charging or account access
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to obtain the Evbee DC-80's log files, which contain the sensitive data written per CWE-532; the supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, unauthenticated access with no user interaction, implying the logs are exposed via a network-accessible interface on the charger. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H) rates this network-reachable, low-complexity, and unauthenticated with high confidentiality impact plus a subsequent-system confidentiality impact (SC:H) - consistent with harvested passwords/UIDs unlocking other systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the charger's log files - via an exposed management/web interface, a log-export function, or local/physical access to the device - retrieves the logs and reads plaintext user passwords and charging card UIDs. The attacker then replays those UIDs and credentials to obtain free charging, impersonate legitimate users, or pivot into any backend account that shares the exposed password. …
Remediation No vendor-released patch version was identified at time of analysis; consult the DIVD advisory at https://csirt.divd.nl/DIVD-2026-00001/ for current fix status and apply the vendor's patched firmware once it is released. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, immediately restrict administrative access to DC-80 charger log files using operating system-level permissions and audit existing logs for unauthorized access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Dc 80

View all
CVE-2026-22103 CRITICAL
9.3 Jul 13

Command injection in the evbee DC-80 EV charger allows remote unauthenticated attackers to execute arbitrary operating-s
CVE-2026-22097 CRITICAL
9.3 Jul 13

Arbitrary code execution in the EVBEE DC-80 EV charging station stems from a firmware update mechanism that ships withou
CVE-2026-22102 CRITICAL
9.3 Jul 13

Arbitrary file write in the Evbee DC-80 EV charging station lets remote unauthenticated attackers overwrite any file on

CVE-2026-22096 CRITICAL
9.3 Jul 13

Missing authentication on the evbee DC-80 EV charging station exposes an administrative web server on TCP port 8090 that
CVE-2026-22095 CRITICAL
9.3 Jul 13

Remote code execution in the evbee DC-80 EV charging station is possible through a command injection flaw in the network
CVE-2026-22099 HIGH
8.7 Jul 13

Bluetooth authentication bypass in the Evbee DC-80 DC EV charging station lets an attacker within radio range issue priv
CVE-2026-22100 HIGH
8.6 Jul 13

OS command injection in the EVBEE DC-80 electric-vehicle DC charger lets an actor who can send OCPP messages execute arb

Same weakness CWE-532 – Insertion of Sensitive Information into Log File

View all
CVE-2023-43261 HIGH POC
7.5
CVE-2025-24984 MEDIUM
4.6
CVE-2017-8075 CRITICAL POC
9.8
CVE-2017-8074 CRITICAL POC
9.8
CVE-2026-22778 CRITICAL POC
9.8
CVE-2019-17395 CRITICAL POC
9.8
CVE-2019-17398 CRITICAL POC
9.8
CVE-2019-17394 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-22098 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy