PT-2026-28362 · Everest · Everest

Secmate · Publicado 2026-03-26 · Atualizado 2026-03-27 · CVE-2026-27828

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2026.02.0

Description EVerest is an EV charging software stack. The ISO15118 chargerImpl::handle session setup function uses the v2g ctx variable after it has been freed when ISO15118 initialization fails, such as when there is no IPv6 link-local address. An attacker with MQTT access can remotely crash the EVSE process by issuing a session setup command while v2g ctx has been released. The vulnerable function is handle session setup. The MQTT protocol is used for communication.

Recommendations Update to version 2026.02.0 or later.

Exploit

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2026-27828

GHSA-5G3V-QC79-QQWR

Produtos afetados

Everest

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27828.json · Exploit
• https://github.com/EVerest/EVerest/security/advisories/GHSA-5g3v-qc79-qqwr · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037513436985217500 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2037515536058208447 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27828 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27828 · Aviso do Fabricante