CVE-2026-22097 describes a critical security vulnerability in the EVbee DC-80 device where the firmware update process does not verify cryptographic signatures. This absence of validation enables unauthorized users with update access to upload arbitrary files, which can result in arbitrary code execution. The vulnerability is categorized under CWE-347 (Improper Verification of Cryptographic Signature). The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

An attacker who can access the firmware update mechanism can upload malicious firmware or files, leading to arbitrary code execution on the device. This compromises the confidentiality, integrity, and availability of the device, potentially allowing full control by the attacker. The vulnerability is critical due to the ease of exploitation (no privileges or user interaction required) and the high impact on system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the firmware update mechanism to trusted personnel only and monitor for unauthorized update attempts. Avoid exposing the update interface to untrusted networks.