Read the docs
TI-2026-17759 Aliases CVE-2026-22093GHSA-8rgr-qqgf-gmfw

Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app

Priority MEDIUM 42CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is weakly encrypted using RC4 with a hardcoded key, which allows an attacker to gain access to the communication. Part of this communication involves access codes to charging stations. This issue affects EVbee Service: v1.4.101.00.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00261 17th percentileScored 2026-11-07
Fix Fixed EVbee Service (EVbee): 1.4.7.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
EVbeeEVbee Servicebefore 1.4.7.101.4.7.10Patch availableCNA
  • EVbee Service VendorEVbee Affected before 1.4.7.10 Fixed in 1.4.7.10 Patch available CNA

Remediation

  • Fix · CNA EVbee Service (EVbee) Fixed in 1.4.7.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22093
  2. 2026-10-03 Alias added: GHSA-8rgr-qqgf-gmfw

References

Advisory 1

  • TI-2026-17769 Command injection in NPC start web endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-17761 Command injection in diagnosis web endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-17768 Arbitrary file overwrite through certificate update functionality CVSS 4.0CRITICAL 9.3
  • TI-2026-17762 Missing authentication for webserver endpoints CVSS 4.0CRITICAL 9.3
  • TI-2026-17763 Missing firmware validation allows remote code execution CVSS 4.0CRITICAL 9.3
  • TI-2026-17760 Weak root password in EVbee DC 80 CVSS 4.0CRITICAL 9.3
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences