Executive brief
A vulnerability in EVbee DC-80 electric vehicle charging stations allows an attacker to remotely write files to the device's internal storage. By sending a specially crafted web request, an attacker could crash the system by overwriting critical files or gain full control over the device by replacing system scripts. This could lead to service outages or unauthorized access to the charging infrastructure.
Technical details
The EVbee DC-80 webserver contains an endpoint that processes POST requests and accepts a filename parameter within the Content-Disposition header without proper validation or sanitization. This improper input validation (CWE-20) allows a remote, unauthenticated attacker to perform arbitrary file writes across the filesystem. By overwriting critical system files, an attacker can cause a denial of service. Alternatively, by overwriting executable shell scripts that are subsequently triggered by other system processes, an attacker can achieve remote code execution (RCE). The vulnerability is addressed in version 1.5.1.
Affected products
- EVbee DC-80 versions before 1.5.1
Timeline
- 2026-07-13: disclosed
- 2026-07-13: advisory