EVbee DC-80 vulnerabilities

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.

A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service by overwriting system files, or remote-code-execution by overwriting shell-scripts which execution can be triggered through other means.

Various sensitive information such as passwords and charging card UIDs are written to log files.

The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.

The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.