The EVbee DC-80 device has a command injection vulnerability (CWE-77) in its network diagnosis endpoint served on port 8090. Improper neutralization of special elements in input to this endpoint allows remote attackers to inject and execute arbitrary commands. The vulnerability is remotely exploitable without authentication, with high impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been published by the vendor as of the report date.

Successful exploitation of this vulnerability can lead to full remote command execution on the EVbee DC-80 device without requiring authentication or user interaction. This compromises the confidentiality, integrity, and availability of the device and potentially the network it resides on. Given the critical CVSS score and the nature of command injection, attackers could gain control over the device, disrupt operations, or use it as a pivot point for further attacks.

No official patch or remediation is currently available from the vendor. Since the device is not a cloud service, remediation depends on vendor updates or workarounds. Users should monitor the vendor advisory for any forthcoming fixes. Until a patch is released, restricting access to the web server on port 8090 through network controls or firewall rules may reduce exposure. Avoid exposing the device's management interface to untrusted networks.