PT-2026-4826 · Everest · Everest

Faeris95 · Published 2026-01-26 · Updated 2026-02-17 · CVE-2026-24003

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.12.1

Description EVerest is an EV charging software stack susceptible to a bypass of sequence state verification, including authentication. This allows sending requests that transition to forbidden states, potentially updating the context with illegitimate data. Specifically, the EVSEManager Charger internal state machine can be tricked into preparing to charge and even prepare to send current through ISO 15118-2 messages published to the MQTT server, while remaining in the WaitingForAuthentication state. Closing the contactors to actually send current requires leaving the WaitingForAuthentication state and leveraging ISO 15118-2 messages.

Recommendations Update to a version newer than 2025.12.1 when available.

Exploit

Fix

Improper Authentication

Incorrect Authorization

Weakness Enumeration

CWE-287

CWE-863

Related Identifiers

CVE-2026-24003

GHSA-9VV5-67CV-9CRQ

Affected Products

Everest

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24003.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-9vv5-67cv-9crq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24003 · Security Note
• https://github.com/EVerest/everest-core/blob/main/modules/EVSE/EvseV2G/iso_server.cpp#L44 · Note
• https://t.me/CVEtracker/43018 · Telegram Post
• https://t.me/cveNotify/152240 · Telegram Post
• https://twitter.com/CVEnew/status/2015919723087638529 · Twitter Post