PatchTheCVE: everest

CVE-2026-33015: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:36:47 +0000

MEDIUM 5.2: EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a RemoteStop (StopTransaction), the EVSE can return to `PrepareCharging` via the EV's BCB toggle, allowing session restart. This breaks the irreversibility of remote stop and can bypass operati

CVE-2026-33014: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:36:46 +0000

MEDIUM 5.2: EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed authorization response restores `authorized` back to true, defeating the `stop_transaction()` call condition on PowerOff events. As a result, the transaction can remain open even after a rem

CVE-2026-33009: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:36:46 +0000

HIGH 8.2: EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (potential memory corruption). This is triggered by an MQTT `everest_external/nodered/{connector}/cmd/switch_three_phases_while_charging` message and results in `Charger::shared_context` / `inter

CVE-2026-29044: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:29:29 +0000

MEDIUM 5.0: EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines `transaction_active=false` and only calls `withdraw_authorization_callback`. This path ultimately calls `Charger::deauthorize()`,

CVE-2026-27828: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:27:45 +0000

HIGH 7.5: EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_setup uses v2g_ctx after it has been freed when ISO15118 initialization fails (e.g., no IPv6 link-local address). The EVSE process can be crashed remotely by an attacker with MQTT access who is

CVE-2026-27816: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:27:44 +0000

CRITICAL 9.1: EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_energy_transfer_modes copies a variable-length list into a fixed-size array of length 6 without bounds checking. With schema validation disabled by default, oversized MQTT Cmd payloads can t

CVE-2026-27815: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:27:43 +0000

CRITICAL 9.1: EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_session_setup copies a variable-length payment_options list into a fixed-size array of length 2 without bounds checking. With schema validation disabled by default, oversized MQTT Cmd payloads can

CVE-2026-27814: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:27:43 +0000

MEDIUM 4.2: EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase ↔ 3-phase switch request (`ac_switch_three_phases_while_charging`) during charging/waiting executes concurrently with the state machine loop. Version 2026.02.0 contains a patch.

CVE-2026-27813: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:27:43 +0000

MEDIUM 5.3: EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to use-after-free. This is triggered by EV plug-in/unplug and RFID/RemoteStart/OCPP authorization events (or delayed authorization response). Version 2026.2.0 contains a patch.

CVE-2026-26074: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:25:41 +0000

HIGH 7.0: EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::map` corruption. The trigger is CSMS GetLog/UpdateFirmware request (network) with an EVSE fault event (physical). This results in TSAN reports concurrent access (data race) to

CVE-2026-26073: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:25:41 +0000

MEDIUM 5.9: EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::queue`/`std::deque` corruption. The trigger is powermeter public key update and EV session/error events (while OCPP not started). This results in a TSAN data race report and an ASAN/UBSAN

CVE-2026-26072: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:25:41 +0000

MEDIUM 4.2: EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::map` concurrent access (container/optional corruption possible). The trigger is EV SoC update with powermeter periodic update and unplugging/SessionFinished status. Version 2026.02.

CVE-2026-26071: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:25:41 +0000

MEDIUM 4.2: EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::string` concurrent access. with heap-use-after-free possible. This is triggered by EVCCID update (EV/ISO15118) and OCPP session/authorization events. Version 2026.02.0 contains a patch.

CVE-2026-26070: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:25:40 +0000

MEDIUM 4.6: EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to `std::map` concurrent access (container/optional corruption possible). The trigger is an EV SoC update with powermeter periodic update and unplugging/SessionFinished state. Version 2026.2

CVE-2026-26008: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:25:35 +0000

HIGH 7.5: EVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access (std::vector) that leads to possible remote crash/memory corruption. This is because the CSMS sends UpdateAllowedEnergyTransferModes over the network. Version 2026.2.0 contains a patch.

CVE-2026-23995: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:22:26 +0000

HIGH 8.4: EVerest is an EV charging software stack. Prior to version 2026.02.0, stack-based buffer overflow in CAN interface initialization: passing an interface name longer than IFNAMSIZ (16) to CAN open routines overflows `ifreq.ifr_name`, corrupting adjacent stack data and enabling potential code execution

CVE-2026-22790: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:20:25 +0000

HIGH 8.8: EVerest is an EV charging software stack. Prior to version 2026.02.0, `HomeplugMessage::setup_payload` trusts `len` after an `assert`; in release builds the check is removed, so oversized SLAC payloads are `memcpy`'d into a ~1497-byte stack buffer, corrupting the stack and enabling remote code execu

CVE-2026-22593: EVerest is an EV charging software stack

Wed, 17 Jun 2026 10:20:07 +0000

HIGH 8.4: EVerest is an EV charging software stack. Prior to version 2026.02.0, an off-by-one check in IsoMux certificate filename handling causes a stack-based buffer overflow when a filename length equals `MAX_FILE_NAME_LENGTH` (100). A crafted filename in the certificate directory can overflow `file_names[