CVE-2026-22103 Details
Description
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.
A command injection vulnerability has been identified in the NPC start endpoint of the web server running on port 8090. This issue affects the EVbee Service App versions prior to 1.4.710 and the DC Quick Charger Firmware versions prior to V1.5.1.
Users are advised to update the EVbee Service App to version 1.4.710 or later and to ensure that the DC Quick Charging Station is connected to update the firmware to version V1.5.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://csirt.divd.nl/DIVD-2026-00001/ | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EVbee Service App | < 1.4.710 (semver) |
CPE
Remediation
| |
| EVbee DC Quick Charger | < V1.5.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |