EUVD-2026-43327Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable OCPP message with low complexity, but sending the ReserveLogin DataTransfer needs a privileged/trusted CSMS session (PR:H); root execution gives full C/I/A impact with unchanged scope.
Primary rating from Vendor (DIVD).
CVSS VectorVendor: DIVD
Lifecycle Timeline
3DescriptionCVE.org
The OCPP DataTransfer message ReserveLogin is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root.
AnalysisAI
OS command injection in the EVBEE DC-80 electric-vehicle DC charger lets an actor who can send OCPP messages execute arbitrary commands as root by tampering with the data value of the vendor-specific ReserveLogin DataTransfer message. The flaw was reported by DIVD (Dutch Institute for Vulnerability Disclosure) and affects the charger's OCPP handling; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because execution occurs as root, successful exploitation results in full compromise of the charging station.
Technical ContextAI
The affected component is the EVBEE DC-80's implementation of OCPP (Open Charge Point Protocol), the standard protocol EV charging stations use to communicate with a Charging Station Management System (CSMS). OCPP defines a generic DataTransfer message intended for vendor-specific extensions; here a vendor action named ReserveLogin passes attacker-controllable input into an OS-level command without sanitization. This maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), the classic root cause where user-supplied data is concatenated into a shell invocation, letting shell metacharacters break out into arbitrary command execution. The single affected product per CPE is cpe:2.3:a:evbee:dc-80.
RemediationAI
No vendor-released patch version is identified in the provided data; consult the DIVD advisory at https://csirt.divd.nl/DIVD-2026-00001/ and EVBEE for firmware updates and apply any released fix as the primary remediation. As compensating controls, restrict which systems can open OCPP sessions to the DC-80 - place chargers on an isolated management VLAN and firewall the OCPP port so only the trusted CSMS backend can reach it, which prevents lateral actors from sending the malicious ReserveLogin DataTransfer message (trade-off: requires network segmentation and breaks any direct third-party integrations). Enforce mutual TLS and strong per-station credentials on the OCPP/CSMS channel so a compromised or rogue peer cannot impersonate the management system, and if the vendor-specific ReserveLogin action is not operationally required, ask the vendor whether it can be disabled. Monitor OCPP DataTransfer traffic for anomalous ReserveLogin payloads containing shell metacharacters as a detection measure.
Command injection in the evbee DC-80 EV charger allows remote unauthenticated attackers to execute arbitrary operating-s
Arbitrary code execution in the EVBEE DC-80 EV charging station stems from a firmware update mechanism that ships withou
Arbitrary file write in the Evbee DC-80 EV charging station lets remote unauthenticated attackers overwrite any file on
Missing authentication on the evbee DC-80 EV charging station exposes an administrative web server on TCP port 8090 that
Remote code execution in the evbee DC-80 EV charging station is possible through a command injection flaw in the network
Sensitive-data logging in the Evbee DC-80 DC EV charger writes secrets such as user passwords and charging card (RFID) U
Bluetooth authentication bypass in the Evbee DC-80 DC EV charging station lets an attacker within radio range issue priv
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today