by Kastro
Paper/Archive/CVE-2026-22096

CVE-2026-22096

EVbee DC-80 — Missing authentication for webserver endpoints

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 45.8.458 × 209.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.

Affected

ProductAffectedFixed inSource
DC-80< 1.5.11.5.1CNA

Scores by source

DIVD (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcsirt.divd.nl/DIVD-2026-00001