csirt@divd.nl
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS csirt@divd.nl
03
assessed vulnerabilities (111)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-102490US | high7.8OT critical | KEV | ||
Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to… | ||||
| CVE-2026-102489US | critical9.8OT critical | KEV | ||
Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to ver… | ||||
| CVE-2026-22101US | — | — | ||
The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi networ… | ||||
| CVE-2026-22094US | — | — | ||
The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network. | ||||
| CVE-2026-22104US | — | — | ||
Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked hashes of a Hashtop… | ||||
| CVE-2026-22103US | — | — | ||
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. | ||||
| CVE-2026-22102US | — | — | ||
A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header… | ||||
| CVE-2026-22100US | — | — | ||
The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root. | ||||
| CVE-2026-22099US | — | — | ||
The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering reboots… | ||||
| CVE-2026-22098US | — | — | ||
Various sensitive information such as passwords and charging card UIDs are written to log files. | ||||
| CVE-2026-22097US | — | — | ||
The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which… | ||||
| CVE-2026-22096US | —OT elevated | — | ||
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different… | ||||
| CVE-2026-22095US | — | — | ||
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. | ||||
| CVE-2026-22093US | — | — | ||
The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path be… | ||||
| CVE-2025-36754US | — | — | ||
The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new settings since there i… | ||||
| CVE-2025-36753US | critical9.8 | — | ||
The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets… | ||||
| CVE-2025-36752US | critical9.8OT elevated | — | ||
Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any a… | ||||
| CVE-2025-36751US | —OT elevated | — | ||
Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept and potentially manipu… | ||||
| CVE-2025-36750US | medium5.4 | — | ||
ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page via a direct post. This… | ||||
| CVE-2025-36748US | medium5.4 | — | ||
ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the communication module… | ||||