CVE-2026-22093

CriticalCVSS 9.5/10Last modified Oct 24, 2026

Description

The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is weakly encrypted using RC4 with a hardcoded key, which allows an attacker to gain access to the communication. Part of this communication involves access codes to charging stations.

This issue affects EVbee Service: v1.4.101.00.

Metrics

CVSS 4.0 9.5/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-220949.3The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is ex CVE-2026-220959.3The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.CVE-2026-220969.3The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwor CVE-2026-220979.3The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update cap CVE-2026-220989.2Various sensitive information such as passwords and charging card UIDs are written to log files.CVE-2026-220998.7The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive CVE-2026-22107.2A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manip CVE-2026-221008.6The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can b CVE-2026-221015.1The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial CVE-2026-221029.3A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename par CVE-2026-221039.3The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.CVE-2026-221047.1Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account