Threat Intelligence Database

CVE-2025-68137 is a high-severity buffer overflow vulnerability in the EVerest everest-core EV charging software stack versions prior to 2025.10.0. It arises from an integer overflow in the SdpPacket::parse_header() function, causing incorrect buffer length calculations that lead to either an infinite loop or a stack buffer overflow depending on the server configuration (TCP or TLS). This vulnerability can result in full compromise of confidentiality, integrity, and availability without requiring authentication or user interaction. The flaw is fixed in version 2025.10.0. European organizations operating EV charging infrastructure using affected versions are at risk of service disruption and potential remote code execution. Mitigation requires immediate upgrade to the patched version and careful network segmentation of EV charging systems.

HighVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-68137#cwe-120

EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a RemoteStop (StopTransaction), the EVSE can return to `PrepareCharging` via the EV's BCB toggle, allowing session restart. This breaks the irreversibility of remote stop and can bypass operational/billing/safety controls. Version 2026.02.0 contains a patch.

MediumVulnerabilityUnited StatesGermanyChina+7#cve#cve-2026-33015#cwe-863

EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed authorization response restores `authorized` back to true, defeating the `stop_transaction()` call condition on PowerOff events. As a result, the transaction can remain open even after a remote stop. Version 2026.02.0 contains a patch.

MediumVulnerabilityUnited StatesGermanyChina+7#cve#cve-2026-33014#cwe-863

CVE-2026-33009 is a high-severity race condition vulnerability in the EVerest everest-core EV charging software stack versions prior to 2026.02.0. The issue arises from concurrent access to shared context objects without proper locking, triggered by a specific MQTT message. This can lead to undefined behavior and potential memory corruption. The vulnerability has been patched in version 2026.02.0.

EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed before the TransactionStarted event, AuthHandler determines `transaction_active=false` and only calls `withdraw_authorization_callback`. This path ultimately calls `Charger::deauthorize()`, but no actual stop (StopTransaction) occurs in the Charging state. As a result, authorization withdrawal can be defeated by timing, allowing charging to continue. Version 2026.02.0 contains a patch.

MediumVulnerabilityUnited StatesGermanyChina+7#cve#cve-2026-29044#cwe-863

CVE-2026-27828 is a use-after-free vulnerability in the EVerest everest-core EV charging software stack prior to version 2026.02.0. The issue occurs in the ISO15118_chargerImpl::handle_session_setup function, which uses a freed v2g_ctx object when ISO15118 initialization fails, such as when no IPv6 link-local address is present. An attacker with MQTT access can remotely crash the EVSE process by issuing a session_setup command under these conditions. The vulnerability has a medium severity with a CVSS score of 5.5. Version 2026.02.0 contains a patch that addresses this issue.

EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_energy_transfer_modes copies a variable-length list into a fixed-size array of length 6 without bounds checking. With schema validation disabled by default, oversized MQTT Cmd payloads can trigger out-of-bounds writes and corrupt adjacent EVSE state or crash the process. Version 2026.02.0 contains a patch.

MediumVulnerabilityUnited StatesGermanyChina+9#cve#cve-2026-27816#cwe-787

CVE-2026-27815 is a medium severity vulnerability in the EVerest everest-core EV charging software stack prior to version 2026.02.0. It involves an out-of-bounds write caused by copying a variable-length payment_options list into a fixed-size array of length 2 without bounds checking. This occurs in the ISO15118_chargerImpl::handle_session_setup function. Since schema validation is disabled by default, oversized MQTT command payloads can trigger this vulnerability, potentially corrupting adjacent EVSE state or causing the process to crash. A patch addressing this issue is included in version 2026.02.0.

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase ↔ 3-phase switch request (`ac_switch_three_phases_while_charging`) during charging/waiting executes concurrently with the state machine loop. Version 2026.02.0 contains a patch.

MediumVulnerabilityUnited StatesGermanyChina+7#cve#cve-2026-27814#cwe-362

CVE-2026-27813 is a use-after-free vulnerability in the everest-core component of the EVerest EV charging software stack. Versions prior to 2026.02.0 are affected due to a data race condition triggered by EV plug-in/unplug events and authorization processes such as RFID, RemoteStart, or OCPP. This vulnerability has been patched in version 2026.02.0. The CVSS score is 5.3, indicating a medium severity level with potential impacts on confidentiality, integrity, and availability.