The EVbee DC-80 device's web server exposes a network diagnosis endpoint on port 8090 that is vulnerable to command injection due to improper neutralization of special elements (CWE-77). This allows unauthenticated remote attackers to execute arbitrary commands on the underlying system. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, reflecting its network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor patch or mitigation has been published yet.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary commands on the EVbee DC-80 device without authentication. This can lead to full compromise of the device, including unauthorized access to sensitive information, disruption of device functionality, and potential use as a foothold for further network attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's web server port 8090 to trusted networks only and monitor for suspicious activity targeting this endpoint.