The EVbee DC-80 device is affected by an OS command injection vulnerability (CWE-78) in the OCPP DataTransfer message 'ReserveLogin'. An attacker can manipulate the data value in this message to execute arbitrary operating system commands as root. This vulnerability allows remote attackers to gain high-privilege command execution without user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required to attack but high privileges required to exploit, and high impact on confidentiality, integrity, and availability. No official remediation or patch information is provided, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary OS commands as root on the affected EVbee DC-80 device. This can lead to full system compromise, including unauthorized access, data manipulation, and disruption of device functionality. The high CVSS score reflects the critical nature of this vulnerability in terms of confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device and monitor for suspicious activity related to OCPP DataTransfer messages. Avoid exposing the device to untrusted networks. Follow vendor communications for updates on patches or mitigations.