DIVD: EVBee Service App & DC Quick Charging Station Firmware Vulnerabilities (CVE-2026-22093 to 22103)

Vulnerability Overview DIVD-2026-00001 reports multiple vulnerabilities in the EVBEE SERVICE APP and DC QUICK CHARGING STATION. These vulnerabilities include man-in-the-middle attacks, command injection, missing authentication, sensitive information disclosure, arbitrary file overwrite, and others. Affected Products EVBee Service App: Multiple vulnerabilities are present, including man-in-the-middle attacks, command injection, and missing authentication. DC Quick Charging Station Firmware: Multiple vulnerabilities are present, including command injection, missing authentication, and arbitrary file overwrite. Remediation EVBee Service App: Users are advised to update the service application. DC Quick Charging Station: Ensure that the DC Quick Charging Station has network connectivity to update the firmware. Vulnerability Details CVE-2026-22093: Man-in-the-middle attack vulnerability CVE-2026-22094: Command injection in diagnostic web endpoint CVE-2026-22095: Missing authentication on web endpoint CVE-2026-22097: Missing firmware verification allows remote code execution CVE-2026-22098: Sensitive information written to logs CVE-2026-22099: Missing authentication in Bluetooth communication CVE-2026-22100: Command injection in OCPP ResolveLogin message CVE-2026-22102: Arbitrary file overwrite via certificate update feature CVE-2026-22103: Command injection in RPC startup endpoint Timeline January 5, 2026: Initial disclosure to EVBee, supporting DIVD in CVE registration July 10, 2026: Publication of initial vulnerability batch Additional Information CVE-2026-22093 CVE-2026-22094 CVE-2026-22095 CVE-2026-22097 CVE-2026-22098 CVE-2026-22099 CVE-2026-22100 CVE-2026-22102 CVE-2026-22103 Code Snippets No Proof of Concept (POC) code or exploit code was included in the report.

Goal Reached Thanks to every supporter — we hit 100%!

DIVD: EVBee Service App & DC Quick Charging Station Firmware Vulnerabilities (CVE-2026-22093 to 22103)