CVE-2026-22097 is a critical vulnerability in the EVbee DC-80 firmware update mechanism due to the absence of cryptographic signature validation (CWE-347). This flaw permits anyone with access to the firmware update capability to upload arbitrary files, potentially resulting in arbitrary code execution on the device. The vulnerability is remotely exploitable without authentication or user interaction, with a CVSS 4.0 score of 9.3. As of the published date, no official fix or patch has been disclosed, and the vendor has not provided remediation guidance.

An attacker with access to the firmware update function can upload malicious firmware or files, leading to arbitrary code execution. This compromises the device's integrity and potentially allows full control over the affected system. The vulnerability is remotely exploitable without authentication, increasing the risk of widespread exploitation if access is gained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the firmware update mechanism to trusted personnel only and monitor for unauthorized update attempts.