CVE-2026-22093
Received Received - Intake

EVbee Service Android App TLS Certificate Validation Bypass

Publication date: 2026-07-13

Last updated on: 2026-07-13

Assigner: Dutch Institute for Vulnerability Disclosure

Description
The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is weakly encrypted using RC4 with a hardcoded key, which allows an attacker to gain access to the communication. Part of this communication involves access codes to charging stations. This issue affects EVbee Service: v1.4.101.00.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-13
Last Modified
2026-07-13
Generated
2026-07-13
AI Q&A
2026-07-13
EPSS Evaluated
N/A
NVD
CVE-2026-22093
EUVD
EUVD-2026-43325

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
evbee_service evbee_service 1.4.101.00

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The EVbee Service Android app uses TLS encrypted communication (HTTPS) but does not validate the server's certificate. This means an attacker positioned between the app and the EVbee server can intercept and manipulate the communication.

Additionally, the communication is weakly encrypted using RC4 with a hardcoded key, which makes it easier for an attacker to gain access to the data being transmitted.

Part of the intercepted communication includes access codes to charging stations, which could be sensitive information.

Impact Analysis

An attacker on the network path can intercept and manipulate the communication between the app and the server.

  • They can gain access to sensitive information such as access codes to charging stations.
  • This could lead to unauthorized use of charging stations or other malicious activities.
  • The weak encryption and lack of certificate validation increase the risk of data compromise and man-in-the-middle attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-22093. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart