CVE-2026-22093

Katalog CVE

CVSS 9.5 · Critical EPSS 0,26%

Kerentanan Improper Certificate Validation. Skor CVSS 4.0 9.5 (Critical) menurut divd.nl.

Deskripsi (NVD)

The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is weakly encrypted using RC4 with a hardcoded key, which allows an attacker to gain access to the communication. Part of this communication involves access codes to charging stations. This issue affects EVbee Service: v1.4.101.00.

Rincian

Terbit di NVD

13 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Deferred

CVSS 4.0

9.5 (Critical), sumber divd.nl
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://csirt.divd.nl/DIVD-2026-00001/