CVE-2026-22096criticalCWE-306

CVE-2026-22096: falha crítica em EVbee DC-80

Missing authentication for webserver endpoints

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar DC-80

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.5%
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
EVbee · DC-80
CVEs relacionadas — EVbee DC-80

No mesmo produto, das mais perigosas para as menos.

CVE-2026-22103CRITICALCommand injection in NPC start web endpointEPSS 1.4%CVE-2026-22095CRITICALCommand injection in diagnosis web endpointEPSS 1.4%CVE-2026-22100HIGHComnand injection in OCPP ReserveLogin messageEPSS 1.1%CVE-2026-22102CRITICALArbitrary file overwrite through certificate update functionalityEPSS 0.5%CVE-2026-22098CRITICALSensitive information is written to logsEPSS 0.4%CVE-2026-22097CRITICALMissing firmware validation allows remote code executionEPSS 0.3%