by Kastro
Paper/Archive/CVE-2026-22097

CVE-2026-22097

EVbee DC-80 — Missing firmware validation allows remote code execution

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
33
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 26.8.268 × 205.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.

Affected

ProductAffectedFixed inSource
DC-80< 1.5.11.5.1CNA

Scores by source

DIVD (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupcsirt.divd.nl/DIVD-2026-00001