CVE-2026-22097

CriticalCVSS 9.3/10Last modified Oct 24, 2026

Description

The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-347

Affected software

VendorProductVersions
EVbeeDC-80< 1.5.1

References

Timeline

Published
Jul 13, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-220989.2Various sensitive information such as passwords and charging card UIDs are written to log files.CVE-2026-220998.7The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitiveCVE-2026-22107.2A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manipCVE-2026-221008.6The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can bCVE-2026-221015.1The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serialCVE-2026-221029.3A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parCVE-2026-221039.3The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.CVE-2026-221047.1Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created accountCVE-2026-221058.7Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. ACVE-2026-221098.4The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical acCVE-2026-22119.8A vulnerability was determined in code-projects Online Music Site 1.0. Affected is an unknown function of the file /Administrator/PHP/AdminDCVE-2026-221108.7The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the config
CVE-2026-22097: Critical severity, CVSS 9.3 | Vulnix