A hidden service menu in the EVbee DC‑80 device can be accessed through physical interaction. Once entered, the menu reveals confidential data, including the unit’s serial number, MAC address, and associated Wi‑Fi network and password. The weakness is a confidentiality breach (CWE‑200) that allows an attacker to obtain sensitive information that could facilitate further compromise, such as network reconnaissance or targeted credential attacks. The impact is therefore the disclosure of potentially exploitable network and device credentials, which can be used by adversaries to gain higher foothold in an environment.

The vulnerability is present in the EVbee DC‑80 device. No specific firmware or hardware version information is listed, so all current and unknown versions are potentially affected until an official fix is released.

The CVSS score of 5.1 places the issue in the medium range. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation at the time of reporting. The likely attack vector is physical access to the device, after which an attacker can navigate the obfuscated menu to harvest the exposed data. In the absence of a publicly acknowledged exploit, the risk is primarily the personal or network data leakage rather than a direct service disruption or remote code execution.