EUVD-2026-43333Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable command injection (AV:N/AC:L/PR:N/UI:N) yields full OS command execution, so confidentiality, integrity, and availability are all High; scope unchanged.
Primary rating from Vendor (DIVD).
CVSS VectorVendor: DIVD
Lifecycle Timeline
3DescriptionCVE.org
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.
AnalysisAI
Command injection in the evbee DC-80 EV charger allows remote unauthenticated attackers to execute arbitrary operating-system commands via the 'NPC start' endpoint exposed on the device's web server at TCP port 8090. Reported by DIVD (Dutch Institute for Vulnerability Disclosure), the flaw carries a CVSS 4.0 base score of 9.3 with a fully network-exploitable vector (AV:N/PR:N/UI:N) and high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; no EPSS score was supplied.
Technical ContextAI
The affected device is the evbee DC-80, a networked electric-vehicle DC charging station (CPE cpe:2.3:a:evbee:dc-80). It runs an embedded HTTP management service on port 8090 that exposes an 'NPC start' function. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning attacker-controlled input reaching this endpoint is passed into an OS command interpreter without adequate sanitization or argument separation. Such flaws in embedded/IoT firmware typically stem from shell invocations (e.g. system()/popen or backtick expansion) that concatenate untrusted parameters, letting metacharacters (;, |, &, $()) inject additional commands executed with the privileges of the web service - often root on constrained embedded Linux devices.
RemediationAI
No vendor-released patch identified at time of analysis; monitor the DIVD advisory at https://csirt.divd.nl/DIVD-2026-00001/ and the evbee vendor for firmware updates and apply the fixed build as soon as it is published. As compensating controls until a patch is available: restrict network access to TCP port 8090 so the management interface is reachable only from a trusted management VLAN or via VPN, and place the charger behind a firewall that blocks 8090 from the internet and general user networks (trade-off: legitimate remote management must be routed through the allowed path). If the device supports it, disable or firewall the web management service when not in active use, and segment EV-charging OT infrastructure away from corporate and public networks (trade-off: may complicate remote monitoring/telemetry). Because exploitation is unauthenticated command injection, network-layer access restriction is the most effective interim mitigation.
Arbitrary code execution in the EVBEE DC-80 EV charging station stems from a firmware update mechanism that ships withou
Arbitrary file write in the Evbee DC-80 EV charging station lets remote unauthenticated attackers overwrite any file on
Missing authentication on the evbee DC-80 EV charging station exposes an administrative web server on TCP port 8090 that
Remote code execution in the evbee DC-80 EV charging station is possible through a command injection flaw in the network
Sensitive-data logging in the Evbee DC-80 DC EV charger writes secrets such as user passwords and charging card (RFID) U
Bluetooth authentication bypass in the Evbee DC-80 DC EV charging station lets an attacker within radio range issue priv
OS command injection in the EVBEE DC-80 electric-vehicle DC charger lets an actor who can send OCPP messages execute arb
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today