TI-2026-17769 CVE-2026-22103 · GHSA-6f5q-g982-5373
Command injection in NPC start web endpoint
Priority MEDIUM 51
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.
EVbee
Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
EVbee records in CISA KEVNo EVbee vulnerabilities are listed in CISA KEV.
Records
11 records
TI-2026-17761 CVE-2026-22095 · GHSA-644p-7q3w-636g
Command injection in diagnosis web endpoint
Priority MEDIUM 51
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.
TI-2026-17768 CVE-2026-22102 · GHSA-7jrx-8jxh-496c
Arbitrary file overwrite through certificate update functionality
Priority MEDIUM 49
A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations.
TI-2026-17762 CVE-2026-22096 · GHSA-56jh-x7v6-jq26
Missing authentication for webserver endpoints
Priority MEDIUM 49
The webserver running on port 8090 does not require authentication.
TI-2026-17763 CVE-2026-22097 · GHSA-fmp2-hp5c-w25p
Missing firmware validation allows remote code execution
Priority MEDIUM 48
The firmware update mechanism does not include cryptographic signature validation.
TI-2026-17760 CVE-2026-22094 · GHSA-m8j5-qffh-wq39
Weak root password in EVbee DC 80
Priority MEDIUM 48
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.
TI-2026-17764 CVE-2026-22098 · GHSA-86f2-h28h-r4fm
Sensitive information is written to logs
Priority MEDIUM 46
Various sensitive information such as passwords and charging card UIDs are written to log files.
TI-2026-17759 CVE-2026-22093 · GHSA-8rgr-qqgf-gmfw
Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app
Priority MEDIUM 42
The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server.
TI-2026-17766 CVE-2026-22100 · GHSA-28mc-whm7-9h23
Comnand injection in OCPP ReserveLogin message
Priority MEDIUM 41
The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection.
TI-2026-17765 CVE-2026-22099 · GHSA-p256-gw98-w4cg
Missing authentication for Bluetooth communication
Priority LOW 39
The charging station does not require authentication for Bluetooth commands to perform actions.
TI-2026-17767 CVE-2026-22101 · GHSA-vwwj-5jxp-3fgw
Sensitive information leak through hidden menu
Priority LOW 22
The access to the service menu is obfuscated, but possible with only physical access.