PT-2026-28335 · Everest · Everest

Finder16 · Publicado 2026-03-26 · Atualizado 2026-03-29 · CVE-2026-23995

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2026.02.0

Description EVerest is an EV charging software stack. A stack-based buffer overflow exists in the CAN interface initialization process. This occurs when an interface name exceeding IFNAMSIZ (16 characters) is passed to CAN open routines, overflowing the ifreq.ifr name buffer and potentially corrupting adjacent stack data, which could lead to code execution. A malicious or misconfigured interface name can trigger this issue before any privilege checks are performed.

Recommendations Versions prior to 2026.02.0 should be updated to version 2026.02.0 or later.

Exploit

Correção

Stack Overflow

Enumeração de Fraquezas

CWE-121

Identificadores relacionados

CVE-2026-23995

GHSA-P47C-2JPR-MPWX

Produtos afetados

Everest

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23995.json · Exploit
• https://github.com/EVerest/EVerest/security/advisories/GHSA-p47c-2jpr-mpwx · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2038135182478438587 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23995 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2037288641396146604 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23995 · Aviso do Fabricante