Skip to main content

Evbee DC-80 CVE-2026-22099

| EUVDEUVD-2026-43330 HIGH
Improper Authentication (CWE-287)
2026-07-13 DIVD
Authentication Bypass Dc 80
8.7
CVSS 4.0 · Vendor: DIVD
Share

Severity by source

Vendor (DIVD) PRIMARY
8.7 HIGH
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Bluetooth range gives AV:A with low complexity, and the unauthenticated command interface (PR:N, no UI) yields full C/I/A impact via info leak, firmware push, and reboot.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (DIVD).

CVSS VectorVendor: DIVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Jul 13, 2026 - 12:01 EUVD
Analysis Generated
Jul 13, 2026 - 11:10 vuln.today
CVE Published
Jul 13, 2026 - 09:10 cve.org
HIGH 8.7

DescriptionCVE.org

The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering reboots, or pushing a firmware update URL.

AnalysisAI

Bluetooth authentication bypass in the Evbee DC-80 DC EV charging station lets an attacker within radio range issue privileged commands without any credentials, enabling sensitive information disclosure, forced reboots, and - most dangerously - the ability to push an arbitrary firmware update URL to the device. Reported by DIVD (DIVD-2026-00001), it carries CVSS 4.0 base 8.7 (High). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Approach charger within Bluetooth range
Delivery
Connect to unauthenticated BLE command interface
Exploit
Issue privileged command without auth
Execution
Leak data, reboot, or push firmware URL
Impact
Deny service or load malicious firmware
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to be within Bluetooth (Adjacent) radio range of the Evbee DC-80 and able to connect to its Bluetooth command interface, which accepts action commands with no authentication (PR:N) and no user interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) is internally consistent with the description: exploitation requires only proximity (Adjacent = Bluetooth range), no authentication, no user interaction, and low complexity, yielding full confidentiality, integrity, and availability impact on the vulnerable system while subsequent-system impact is None. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker loiters within Bluetooth range of a publicly sited Evbee DC-80 charger, connects to its unauthenticated BLE command interface, and issues commands to read sensitive information and repeatedly reboot the unit to deny service. Escalating, the attacker pushes a malicious firmware update URL to attempt to load attacker-controlled firmware onto the charger. …
Remediation No vendor-released patch identified at time of analysis; the only reference is the DIVD coordination advisory at https://csirt.divd.nl/DIVD-2026-00001/, which should be monitored for a fixed firmware version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: conduct an asset inventory of all Evbee DC-80 chargers, document their locations and current firmware versions, and assess exposure in your network perimeter. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Dc 80

View all
CVE-2026-22103 CRITICAL
9.3 Jul 13

Command injection in the evbee DC-80 EV charger allows remote unauthenticated attackers to execute arbitrary operating-s
CVE-2026-22097 CRITICAL
9.3 Jul 13

Arbitrary code execution in the EVBEE DC-80 EV charging station stems from a firmware update mechanism that ships withou
CVE-2026-22102 CRITICAL
9.3 Jul 13

Arbitrary file write in the Evbee DC-80 EV charging station lets remote unauthenticated attackers overwrite any file on

CVE-2026-22096 CRITICAL
9.3 Jul 13

Missing authentication on the evbee DC-80 EV charging station exposes an administrative web server on TCP port 8090 that
CVE-2026-22095 CRITICAL
9.3 Jul 13

Remote code execution in the evbee DC-80 EV charging station is possible through a command injection flaw in the network
CVE-2026-22098 CRITICAL
9.2 Jul 13

Sensitive-data logging in the Evbee DC-80 DC EV charger writes secrets such as user passwords and charging card (RFID) U
CVE-2026-22100 HIGH
8.6 Jul 13

OS command injection in the EVBEE DC-80 electric-vehicle DC charger lets an actor who can send OCPP messages execute arb

Same weakness CWE-287 – Improper Authentication

View all
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8
CVE-2024-53704 CRITICAL POC
9.8
CVE-2015-7755 CRITICAL POC
9.8
CVE-2013-0625 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-22099 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy