PT-2026-4826 · Everest · Everest

Faeris95 · Publicado 2026-01-26 · Atualizado 2026-02-17 · CVE-2026-24003

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.12.1

Description EVerest is an EV charging software stack susceptible to a bypass of sequence state verification, including authentication. This allows sending requests that transition to forbidden states, potentially updating the context with illegitimate data. Specifically, the EVSEManager Charger internal state machine can be tricked into preparing to charge and even prepare to send current through ISO 15118-2 messages published to the MQTT server, while remaining in the WaitingForAuthentication state. Closing the contactors to actually send current requires leaving the WaitingForAuthentication state and leveraging ISO 15118-2 messages.

Recommendations Update to a version newer than 2025.12.1 when available.

Exploit

Correção

Improper Authentication

Incorrect Authorization

Enumeração de Fraquezas

CWE-287

CWE-863

Identificadores relacionados

CVE-2026-24003

GHSA-9VV5-67CV-9CRQ

Produtos afetados

Everest

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24003.json · Exploit
• https://github.com/EVerest/everest-core/blob/main/modules/EVSE/EvseV2G/iso_server.cpp#L44 · Nota
• https://github.com/EVerest/everest-core/security/advisories/GHSA-9vv5-67cv-9crq · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-24003 · Aviso do Fabricante
• https://t.me/CVEtracker/43018 · Publicação no Telegram
• https://t.me/cveNotify/152240 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24003 · Nota de Segurança
• https://twitter.com/CVEnew/status/2015919723087638529 · Publicação no Twitter