Quick answers
- Is CVE-2026-22093 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-22093 being exploited in the wild.
- How severe is CVE-2026-22093?
- Informational severity, with a CVSS score of 9.5, published 13 July 2026.
- Which products and versions are affected?
- EVbee Service v1.4.101.00 and earlier.
- Is there a fix for CVE-2026-22093?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-22093 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-22093?
- Check whether you run EVbee Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The EVbee Service Android app (v1.4.101.00) is vulnerable to a Man-in-the-Middle (MitM) attack due to improper certificate validation (CWE-295). While the app uses HTTPS, it does not validate the server-provided certificate, allowing an attacker on the network path to intercept traffic. Furthermore, the application employs a secondary layer of weak encryption using the RC4 algorithm with a hardcoded key. An attacker can exploit these weaknesses to decrypt, view, and modify sensitive data in transit, specifically charging station access codes. The vulnerability is exploitable by any network-adjacent or remote attacker capable of intercepting the app's traffic.
Affected products
- EVbee EVbee Service v1.4.101.00 and earlier
Timeline
- 2026-07-13: advisory: CVE-2026-22093 published by DIVD and NVD