Description
The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| EVbee | DC-80 | < 1.5.1 | 1.5.1 |
References
- https://csirt.divd.nl/DIVD-2026-00001/ third-party-advisory