CVE-2026-22093: EVbee Service App Info Disclosure Flaw

CVE-2026-22093 Overview

CVE-2026-22093 affects the EVbee Service Android application version v1.4.101.00. The app uses HTTPS to communicate with the EVbee backend but fails to validate the server-provided TLS certificate. An attacker positioned on the network path can intercept and manipulate traffic between the mobile client and the EVbee server. Application payloads are further protected only by RC4 encryption using a hardcoded key, providing no meaningful confidentiality once traffic is captured. The intercepted communication includes access codes for electric vehicle charging stations, allowing an attacker to abuse charging infrastructure. This vulnerability maps to [CWE-295: Improper Certificate Validation].

Critical Impact
Attackers on the network path can decrypt and modify EVbee Service traffic, steal charging station access codes, and impersonate the backend service.

Affected Products

EVbee Service Android application v1.4.101.00
EVbee mobile client communications with backend infrastructure
Charging station access-code workflows exposed to the affected app

Discovery Timeline

2026-07-13 - CVE-2026-22093 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-22093

Vulnerability Analysis

The EVbee Service Android app establishes TLS sessions to the EVbee backend but skips certificate validation. Any certificate, including one issued by an attacker-controlled certificate authority or a self-signed certificate, is accepted by the client. This defect enables a straightforward man-in-the-middle (MITM) attack against every user of the affected version.

On top of the broken transport layer, the application applies a secondary layer of encryption using RC4 with a hardcoded key embedded in the app binary. RC4 is a deprecated stream cipher with well-known cryptographic weaknesses. Because the key ships with the client, any attacker who extracts the APK can recover it and decrypt captured traffic offline. The combined effect is that TLS provides no assurance and the payload obfuscation provides no confidentiality.

The intercepted traffic contains access codes used to unlock and start charging sessions at EVbee-connected stations. An attacker can harvest these codes for fraudulent charging, session hijacking, or resale.

Root Cause

The root cause is improper certificate validation in the app's HTTPS client, combined with reliance on a broken symmetric cipher (RC4) and a hardcoded key for payload protection. The design treats obfuscation as a substitute for authenticated transport security.

Attack Vector

The attack requires network adjacency to a victim device, such as a shared Wi-Fi network, a rogue access point, or an upstream network position. The attacker presents any TLS certificate to the EVbee client, terminates the session, decrypts the RC4-wrapped payloads using the extracted hardcoded key, and forwards or modifies requests to the real EVbee backend. No user interaction beyond normal app usage is required. Full technical details are available in the DIVD Security Advisory.

Detection Methods for CVE-2026-22093

Indicators of Compromise

Unexpected TLS certificates presented to EVbee Service clients that do not match the legitimate EVbee backend certificate chain.
Unauthorized charging sessions initiated with access codes tied to accounts that did not originate the session.
Devices connecting to unknown or rogue Wi-Fi access points immediately before EVbee account misuse.

Detection Strategies

Inspect network traffic from mobile fleets for TLS connections to EVbee endpoints presenting non-pinned or unexpected issuer certificates.
Correlate charging station transaction logs with expected user geolocations to identify sessions initiated from unusual network paths.
Perform static analysis of the EVbee APK to confirm the vulnerable version v1.4.101.00 is deployed on managed devices.

Monitoring Recommendations

Enable enterprise mobile device management (MDM) alerts for installation of the affected app version on corporate devices.
Monitor for anomalous RC4-encrypted payloads traversing corporate networks, which indicate the vulnerable client is in active use.
Track EVbee backend authentication logs for repeated failures or reuse of access codes from disparate source IPs.

How to Mitigate CVE-2026-22093

Immediate Actions Required

Restrict use of EVbee Service v1.4.101.00 on managed devices until a fixed version is available from the vendor.
Instruct users to avoid untrusted Wi-Fi networks when interacting with the EVbee app or when charging sessions must be initiated.
Rotate any charging station access codes that may have been transmitted by affected clients.

Patch Information

No vendor patch is referenced in the published advisory at the time of NVD publication. Consult the DIVD Security Advisory for the current remediation status and any vendor-supplied updates. When a fixed version is released, deploy it across all managed devices and verify that the client performs certificate validation and no longer uses RC4 with a static key.

Workarounds

Route mobile traffic through a trusted VPN to reduce exposure to opportunistic network-path attackers.
Use certificate pinning enforcement at the network egress point where feasible, alerting on unexpected certificate chains for EVbee endpoints.
Educate users to report unexpected charging activity and to avoid public or untrusted networks when using the app.

bash

# Configuration example
# No vendor-provided configuration mitigations are available.
# Refer to the DIVD advisory for updates: https://csirt.divd.nl/DIVD-2026-00001/