This vulnerability (CVE-2026-22098) affects the EVbee DC-80 device and involves the insecure logging of sensitive data such as passwords and charging card unique identifiers. The issue is categorized as CWE-532, indicating that sensitive information is exposed through log files. The CVSS 4.0 base score is 9.2 (critical), reflecting the high impact and ease of exploitation due to network attack vector, no required privileges, and no user interaction. There is no vendor advisory or patch information available, and the remediation level is not specified.

The exposure of sensitive information like passwords and charging card UIDs in log files can allow attackers to gain unauthorized access or impersonate legitimate users. Since the vulnerability can be exploited remotely without privileges or user interaction, it poses a significant risk to confidentiality and potentially system integrity. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to log files to trusted personnel only and monitor for unauthorized access attempts. Avoid exposing logs to untrusted networks or users. Follow vendor updates closely for any released patches or official mitigations.