The EVbee DC-80 device contains a vulnerability identified as CVE-2026-22101 (CWE-200) where the service menu, although obfuscated, can be accessed with physical access to the device. This menu reveals sensitive information such as serial numbers, MAC addresses, and WiFi network names and passwords. The CVSS 4.0 base score is 5.1, reflecting medium severity with physical attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. There is no indication of known exploits in the wild or cloud service involvement.

Exposure of sensitive device and network information could facilitate further attacks or unauthorized access if an attacker gains physical access to the device. Confidentiality is impacted due to disclosure of serial numbers, MAC addresses, and WiFi credentials. However, the attack requires physical access and does not allow remote exploitation or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to the device to prevent unauthorized access to the service menu and sensitive information.