CVE-2026-33015
- EPSS 0.03%
- Veröffentlicht 26.03.2026 16:42:50
- Zuletzt bearbeitet 31.03.2026 14:20:51
EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a RemoteStop (StopTransaction), the EVSE can return to `PrepareCharging` via the EV's BCB toggle, allowing session restart. This breaks the irr...
CVE-2026-33014
- EPSS 0.03%
- Veröffentlicht 26.03.2026 16:40:40
- Zuletzt bearbeitet 31.03.2026 13:53:28
EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed authorization response restores `authorized` back to true, defeating the `stop_transaction()` call condition on PowerOff events. As a result...
CVE-2026-33009
- EPSS 0.02%
- Veröffentlicht 26.03.2026 16:39:30
- Zuletzt bearbeitet 31.03.2026 13:30:58
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (potential memory corruption). This is triggered by an MQTT `everest_external/nodered/{connector}/cmd/switch_three_phases_while_charging` message...
CVE-2026-29044
- EPSS 0.02%
- Veröffentlicht 26.03.2026 16:37:33
- Zuletzt bearbeitet 31.03.2026 14:40:50
EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines `transaction_active=false` and only calls `withdraw_authorization_callback`. Thi...
CVE-2026-27828
- EPSS 0.05%
- Veröffentlicht 26.03.2026 16:34:23
- Zuletzt bearbeitet 31.03.2026 14:47:13
EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_setup uses v2g_ctx after it has been freed when ISO15118 initialization fails (e.g., no IPv6 link-local address). The EVSE process can be crash...
CVE-2026-27816
- EPSS 0.05%
- Veröffentlicht 26.03.2026 16:32:05
- Zuletzt bearbeitet 31.03.2026 14:46:38
EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_energy_transfer_modes copies a variable-length list into a fixed-size array of length 6 without bounds checking. With schema validation disa...
CVE-2026-27815
- EPSS 0.05%
- Veröffentlicht 26.03.2026 16:30:29
- Zuletzt bearbeitet 31.03.2026 15:04:28
EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_session_setup copies a variable-length payment_options list into a fixed-size array of length 2 without bounds checking. With schema validation dis...
CVE-2026-27814
- EPSS 0.02%
- Veröffentlicht 26.03.2026 16:27:54
- Zuletzt bearbeitet 31.03.2026 14:53:24
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase ↔ 3-phase switch request (`ac_switch_three_phases_while_charging`) during charging/waiting executes concurrently with the state ...
CVE-2026-27813
- EPSS 0.02%
- Veröffentlicht 26.03.2026 16:23:19
- Zuletzt bearbeitet 30.03.2026 20:56:42
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to use-after-free. This is triggered by EV plug-in/unplug and RFID/RemoteStart/OCPP authorization events (or delayed authorization response). Version 2026....
- EPSS 0.05%
- Veröffentlicht 26.03.2026 16:19:45
- Zuletzt bearbeitet 30.03.2026 20:57:44
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `std::map<std::queue>` corruption. The trigger is CSMS GetLog/UpdateFirmware request (network) with an EVSE fault event (physical). This result...