Which versions of Evbee DC-80 are affected by CVE-2026-22099?

Evbee DC-80 EV charging stations have a critical remote-control vulnerability that allows attackers within radio range to commandeer devices and inject malware without any authentication.. A patch is available.

How to fix or mitigate CVE-2026-22099?

Within 24 hours: conduct an asset inventory of all Evbee DC-80 chargers, document their locations and current firmware versions, and assess exposure in your network perimeter. Within 7 days: disable Bluetooth on all units where not operationally required, implement network segmentation isolating charging infrastructure from critical systems, and restrict physical access to charging station areas with signage and monitoring. Within 30 days: monitor Evbee security advisories (DIVD-2026-00001) for patch availability, evaluate vendor firmware mitigation recommendations, and develop a phased replacement strategy if no patch is released within 90 days.

Evbee DC-80 CVE-2026-22099

Q: What is the CVSS score of CVE-2026-22099?

CVE-2026-22099 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43330 HIGH

Improper Authentication (CWE-287)

2026-07-13 DIVD

Authentication Bypass Dc 80 Evbee

8.7

CVSS 4.0 · Vendor: DIVD

Severity by source

Vendor (DIVD) PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Bluetooth range gives AV:A with low complexity, and the unauthenticated command interface (PR:N, no UI) yields full C/I/A impact via info leak, firmware push, and reboot.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (DIVD).

CVSS VectorVendor: DIVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 13, 2026 - 12:01 EUVD

Analysis Generated

Jul 13, 2026 - 11:10 vuln.today

CVE Published

Jul 13, 2026 - 09:10 cve.org

HIGH 8.7

DescriptionCVE.org

The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering reboots, or pushing a firmware update URL.

AnalysisAI

Bluetooth authentication bypass in the Evbee DC-80 DC EV charging station lets an attacker within radio range issue privileged commands without any credentials, enabling sensitive information disclosure, forced reboots, and - most dangerously - the ability to push an arbitrary firmware update URL to the device. Reported by DIVD (DIVD-2026-00001), it carries CVSS 4.0 base 8.7 (High). No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected device is an Evbee DC-80 electric-vehicle DC charging station (cpe:2.3:a:evbee:dc-80). Like many EV chargers and IoT appliances, it exposes a local Bluetooth (BLE) control channel used for provisioning, diagnostics, and configuration. The root cause maps to CWE-287 (Improper Authentication): the Bluetooth command interface accepts action commands without verifying the identity of the caller, so any device that can pair or connect over the air can invoke functions intended only for an authorized operator. The most severe exposed function - supplying a firmware update URL - effectively lets an unauthenticated peer point the charger at an attacker-controlled firmware source, which is a direct integrity-compromise primitive on embedded hardware.

RemediationAI

No vendor-released patch identified at time of analysis; the only reference is the DIVD coordination advisory at https://csirt.divd.nl/DIVD-2026-00001/, which should be monitored for a fixed firmware version. As compensating controls until a fix is available: physically restrict proximity access to the charger where feasible and site chargers away from areas where an attacker could linger within Bluetooth range; disable or unpair the Bluetooth management interface if the unit supports operating without it (trade-off: loss of local BLE-based provisioning and diagnostics); avoid leaving the device in a pairable/discoverable state after commissioning; and treat any unexpected reboot or firmware-version change as a potential compromise indicator. Because the firmware-update-URL function is the highest-risk capability, confirm with Evbee whether firmware update sources can be pinned or signature-verified, and apply the official firmware update through a trusted channel once released.