EVbee Service App and DC Quick Charger Missing Authentication Vulnerability

A vulnerability has been identified in the webserver running on port 8090, which lacks authentication. This flaw allows for the unauthorized access and leakage of sensitive information, such as configured passwords, and enables file uploads through various endpoints. The issue affects the EVbee Service App prior to version 1.4.710 and DC Quick Charger Firmware prior to V1.5.1.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information and unauthorized file uploads.

Remediation

Users are advised to update the EVbee Service App and ensure that the DC Quick Charging Station is connected to update the firmware.