CVE-2026-22093
CriticalCVSS 9.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The EVbee Service Android app uses TLS encrypted communication but does not validate the server certificate, allowing an attacker on the network path to intercept and manipulate the communication. The traffic is weakly encrypted using RC4 with a hardcoded key, enabling an attacker to gain access to the data, including charging station access codes.
Risk Assessment
The organization is at risk of sensitive data interception, such as charging station access codes, which could lead to unauthorized use of charging infrastructure and potential financial losses.
Recommendation
Immediately update the EVbee Service app to the latest version that fixes this vulnerability and implement certificate validation mechanisms on the client side.
Original NVD description (English source)
The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is weakly encrypted using RC4 with a hardcoded key, which allows an attacker to gain access to the communication. Part of this communication involves access codes to charging stations. This issue affects EVbee Service: v1.4.101.00.