Technical impact
The EVbee DC-80 firmware contains a hardcoded root password that can be used to log in as the superuser through the exposed SSH service. This flaw allows an attacker who can reach the device over the network to gain full administrative control without requiring any credential discovery process. As the attacker attains root privileges, they can modify configurations, install malware, or extract sensitive data, compromising confidentiality, integrity, and availability of the device and potentially the network it serves.
Affected Systems
The vulnerability affects EVbee devices running the DC-80 firmware. No specific firmware version range is provided in the data, so all productions of the DC-80 series with current firmware are presumed vulnerable.
Risk and Exploitability
The CVSS base score of 9.3 indicates critical severity, and the EPSS score is unavailable, so the precise likelihood of exploitation cannot be quantified. The flaw is listed in KEV as not included, but the straightforward nature of the credential leak means exploitation could be trivial once the device is reachable via SSH. The attack vector is inferred to be local network access to the exposed SSH port. No mitigation from the vendor is currently documented, making the risk high until an update is released.
