EVbee DC-80 EUVD-2026-88973

Exploitation requires network reachability to the EVbee DC-80's SSH daemon, which the description states is exposed to the network, plus knowledge of the weak hardcoded root password (recoverable from firmware analysis and shared across all units). No authentication, no user interaction, and no non-default configuration are needed - the SSH service and static credential are present as shipped. The primary limiting factor is network exposure: risk is highest where the charger's SSH port is reachable from untrusted or internet-facing networks and reduced where the device sits behind strict network segmentation or firewalling.

This is a genuine high-priority risk that the raw CVSS 4.0 score of 9.3 accurately reflects, not a paper-inflated number. Every base metric aligns with severe real-world exposure: the network attack vector (AV:N), low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N) mean an unauthenticated attacker with network reachability to the device can log in as root over SSH using a known static password, yielding full confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). Hardcoded credentials (CWE-1391) are the single most trivially exploitable class of flaw once the secret is recovered - extraction typically requires only a firmware dump or one reverse-engineering pass, after which every unpatched unit shares the same key. No EPSS score, CISA KEV listing, or public POC is provided in the input, so there is no evidence of active exploitation or automated weaponization yet; however, absence of these signals does NOT lower the intrinsic risk given how effortless post-disclosure exploitation of shared root credentials is. The main mitigating factor is deployment footprint: EVbee DC-80 is a niche EV DC charging station, so exposure depends on how many units are internet- or LAN-reachable with SSH open. Verify network exposure of the SSH daemon per-site - if these chargers are reachable from untrusted networks, treat as urgent.

An attacker who can reach an EVbee DC-80 charger over the network (LAN, a poorly segmented OT/charging network, or an internet-exposed management interface) connects to the exposed SSH daemon and authenticates as root using the weak hardcoded password recovered from firmware or public disclosure. With root access they can manipulate charging behavior, alter billing/telemetry, disrupt availability, or pivot into the surrounding network. No public exploit code is identified at time of analysis, but the technique is trivial to reproduce once the password is known.