CVE-2026-22096 describes a critical vulnerability in the EVbee DC-80 device where the webserver running on port 8090 does not enforce any authentication. This missing authentication allows attackers to access sensitive data including configured passwords and to perform file uploads via different endpoints. The vulnerability is categorized under CWE-306, indicating missing authentication for critical functions. No patch or official remediation has been documented at this time, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Unauthorized attackers can gain access to sensitive information such as configured passwords and can upload files to the device, potentially leading to compromise of the device and its data. The vulnerability has a high impact on confidentiality, integrity, and availability as indicated by the CVSS vector and score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's port 8090 webserver to trusted users only, and monitor for unauthorized access attempts. Avoid exposing the device's management interface to untrusted networks.