PT-2026-28361 · Everest · Everest

CVE-2026-27816 · Publicado 2026-03-26 · Atualizado 2026-03-27

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2026.02.0

Description EVerest is an EV charging software stack. Prior to version 2026.02.0, the ISO15118 chargerImpl::handle update energy transfer modes function copies a variable-length list into a fixed-size array of length 6 without performing bounds checking. When schema validation is disabled, oversized MQTT Cmd payloads can cause out-of-bounds writes, potentially corrupting adjacent EVSE state or causing the process to crash. The handle update energy transfer modes function is susceptible to this issue.

Recommendations Versions prior to 2026.02.0 should be updated to version 2026.02.0 or later.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2026-27816

GHSA-GQ54-J8F4-XJ8C

Produtos afetados

Everest

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27816.json · Exploit
• https://github.com/EVerest/EVerest/security/advisories/GHSA-gq54-j8f4-xj8c · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27816 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27816 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2037515552835436998 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2037513437954064459 · Publicação no Twitter