EVbee vulnerabilities
We track 7 vulnerabilities in EVbee products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2026.
Latest EVbee vulnerabilities
- 9.3 Critical severity
DC 80: Use of Weak Credentials
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network.
- 9.3 Critical severity
A POST request sent to a specific webserver endpoint can be used to write to arbitrary file…
A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service by overwrit
- 8.6 High severity
DC-80: Improper Neutralization of Special Elements used in an OS Command
The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root.
- 8.7 High severity
DC-80: Improper Authentication
The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering reboots, or pushing a firmware update URL.
- 9.3 Critical severity
DC-80: Improper Verification of Cryptographic Signature
The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.
- 9.3 Critical severity
DC-80: Missing Authentication for Critical Functionality
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.
- 9.5 Critical severity
EVbee Service: Improper Certificate Validation
The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication bet