CVE-2026-22096 describes a critical vulnerability in the EVbee DC-80 device where the webserver running on port 8090 does not enforce any authentication. This missing authentication allows attackers to access sensitive information including configured passwords and to upload files via different endpoints without restriction. The vulnerability is categorized under CWE-306, indicating missing authentication for critical functions. No patch or official remediation has been disclosed by the vendor as of the publication date.

An attacker can gain unauthorized access to sensitive information such as stored passwords and can upload arbitrary files to the device. This could lead to compromise of the device, data leakage, and potentially further exploitation. The vulnerability has a critical severity rating with a CVSS 4.0 score of 9.3, indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's port 8090 webserver to trusted users only and monitor for unauthorized access attempts. Consider isolating the device from untrusted networks to reduce exposure.