CVE-2026-22097

CriticalCVSS 9.3/10Last modified Oct 24, 2026

Description

The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-347

Affected software

VendorProductVersions
EVbeeDC-80< 1.5.1

References

Timeline

Published
Jul 13, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-220989.2Various sensitive information such as passwords and charging card UIDs are written to log files.CVE-2026-220998.7The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitiveCVE-2026-22107.2A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manipCVE-2026-221008.6The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can bCVE-2026-221015.1The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serialCVE-2026-221029.3A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parCVE-2026-221039.3The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.CVE-2026-221047.1Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created accountCVE-2026-22119.8A vulnerability was determined in code-projects Online Music Site 1.0. Affected is an unknown function of the file /Administrator/PHP/AdminDCVE-2026-22129.8A vulnerability was identified in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the filCVE-2026-22137.2A security flaw has been discovered in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the fileCVE-2026-22144.8A weakness has been identified in code-projects for Plugin 1.0. This affects an unknown part of the file /Administrator/PHP/AdminAddAlbum.ph
CVE-2026-22097: Critical severity, CVSS 9.3 | Vulnix