EUVD-2026-43329Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network POST with no user interaction (AV:N/AC:L/PR:N/UI:N); arbitrary file write yields RCE and DoS, giving full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (DIVD).
CVSS VectorVendor: DIVD
Lifecycle Timeline
3DescriptionCVE.org
A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service by overwriting system files, or remote-code-execution by overwriting shell-scripts which execution can be triggered through other means.
AnalysisAI
Arbitrary file write in the Evbee DC-80 EV charging station lets remote unauthenticated attackers overwrite any file on the device by sending a POST request whose Content-Disposition filename parameter is trusted without validation. Because a written file can clobber system files (denial of service) or replace shell scripts that are later executed, this escalates to remote code execution. There is no public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and CWE-20 root cause make this a critical, high-priority flaw.
Technical ContextAI
The affected component is the embedded webserver of the Evbee DC-80, a DC electric-vehicle charging station (CPE cpe:2.3:a:evbee:dc-80). The root cause is CWE-20 (Improper Input Validation): a specific POST endpoint reads the filename from the multipart/form-data Content-Disposition header and uses it directly as a filesystem write path with no canonicalization, allowlisting, or path-traversal checks. This allows an attacker to escape any intended upload directory and write to arbitrary absolute locations. On embedded appliances, web-facing processes commonly run with elevated privileges and the filesystem is writable, so overwriting init/config files or scripts invoked by cron, boot, or service handlers turns a file write into code execution.
RemediationAI
No vendor-released patch identified at time of analysis; the only reference is the DIVD advisory (https://csirt.divd.nl/DIVD-2026-00001/), so monitor it and the Evbee vendor for a firmware update and apply the fixed version once released. As compensating controls until a patch exists: place the charger on an isolated management VLAN and block all inbound access to its web interface from untrusted networks and the internet (trade-off: remote/cloud management or app-based control may break); restrict access to the webserver's upload/POST endpoint to known management hosts via firewall or ACL; and if the device or an upstream proxy allows it, block or strip requests carrying a Content-Disposition filename to the affected endpoint (trade-off: may disable legitimate upload/OTA functionality). Because impact includes overwriting system files, also verify device integrity after exposure.
Command injection in the evbee DC-80 EV charger allows remote unauthenticated attackers to execute arbitrary operating-s
Arbitrary code execution in the EVBEE DC-80 EV charging station stems from a firmware update mechanism that ships withou
Missing authentication on the evbee DC-80 EV charging station exposes an administrative web server on TCP port 8090 that
Remote code execution in the evbee DC-80 EV charging station is possible through a command injection flaw in the network
Sensitive-data logging in the Evbee DC-80 DC EV charger writes secrets such as user passwords and charging card (RFID) U
Bluetooth authentication bypass in the Evbee DC-80 DC EV charging station lets an attacker within radio range issue priv
OS command injection in the EVBEE DC-80 electric-vehicle DC charger lets an actor who can send OCPP messages execute arb
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today