Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Vendor: EVbee Clear all filters
TI-2026-17760 CVE-2026-22094 · GHSA-m8j5-qffh-wq39

Weak root password in EVbee DC 80

Priority MEDIUM 48

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00239 Published 2026-09-29 Fixed in 1.5.6 CWE-1391
TI-2026-17767 CVE-2026-22101 · GHSA-vwwj-5jxp-3fgw

Sensitive information leak through hidden menu

Priority LOW 22

The access to the service menu is obfuscated, but possible with only physical access.

CVSS 4.0MEDIUM 5.1 Physical No auth No interaction EPSS 0.00144 Published 2026-09-29 Fixed in 1.5.6 CWE-200
TI-2026-17769 CVE-2026-22103 · GHSA-6f5q-g982-5373

Command injection in NPC start web endpoint

Priority MEDIUM 51

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01391 Published 2026-07-13 Fixed in 1.5.1 CWE-77
TI-2026-17764 CVE-2026-22098 · GHSA-86f2-h28h-r4fm

Sensitive information is written to logs

Priority MEDIUM 46

Various sensitive information such as passwords and charging card UIDs are written to log files.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00428 Published 2026-07-13 Fixed in 1.5.1 CWE-532
TI-2026-17765 CVE-2026-22099 · GHSA-p256-gw98-w4cg

Missing authentication for Bluetooth communication

Priority LOW 39

The charging station does not require authentication for Bluetooth commands to perform actions.

CVSS 4.0HIGH 8.7 Adjacent network No auth No interaction EPSS 0.003 Published 2026-07-13 Fixed in 1.5.4 CWE-287
TI-2026-17762 CVE-2026-22096 · GHSA-56jh-x7v6-jq26

Missing authentication for webserver endpoints

Priority MEDIUM 49

The webserver running on port 8090 does not require authentication.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00546 Published 2026-07-13 Fixed in 1.5.1 CWE-306
TI-2026-17766 CVE-2026-22100 · GHSA-28mc-whm7-9h23

Comnand injection in OCPP ReserveLogin message

Priority MEDIUM 41

The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.011 Published 2026-07-13 Fixed in 1.5.1 CWE-78
TI-2026-17761 CVE-2026-22095 · GHSA-644p-7q3w-636g

Command injection in diagnosis web endpoint

Priority MEDIUM 51

The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01391 Published 2026-07-13 Fixed in 1.5.1 CWE-77