What is the CVSS score of CVE-2026-22790?

CVE-2026-22790 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Everest are affected by CVE-2026-22790?

CVE-2026-22790 is a remote code execution vulnerability in EVerest electric vehicle charging software that allows attackers on the local network to execute arbitrary code through malformed protocol…. A patch is available.

How to fix or mitigate CVE-2026-22790?

Within 24 hours: Identify all systems running EVerest-core versions prior to 2026.02.0 and isolate charging infrastructure on network segments with restricted adjacent access. Within 7 days: Apply vendor-released patch to EVerest-core 2026.02.0 or later across all affected systems, beginning with production charging stations. Within 30 days: Conduct network access review to restrict non-essential devices from charging station networks and validate patch deployment completion across all inventory.

Everest CVE-2026-22790

EUVD-2026-16197 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-26 GitHub_M

RCE Buffer Overflow Stack Overflow Everest Everest Core

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:13 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 15:00 euvd

EUVD-2026-16197

Analysis Generated

Mar 26, 2026 - 15:00 vuln.today

CVE Published

Mar 26, 2026 - 14:31 nvd

HIGH 8.8

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Prior to version 2026.02.0, HomeplugMessage::setup_payload trusts len after an assert; in release builds the check is removed, so oversized SLAC payloads are memcpy'd into a ~1497-byte stack buffer, corrupting the stack and enabling remote code execution from network-provided frames. Version 2026.02.0 contains a patch.

AnalysisAI

Remote code execution vulnerability in EVerest electric vehicle charging software stack allows adjacent network attackers to execute arbitrary code by sending malformed SLAC protocol frames. EVerest-core versions prior to 2026.02.0 are affected due to a stack buffer overflow in HomeplugMessage::setup_payload that trusts an attacker-controlled length parameter in release builds. SSVC analysis indicates proof-of-concept exploit code exists, though the vulnerability is not automatable and requires adjacent network access (CVSS 8.8, AV:A).

Technical ContextAI

The vulnerability affects everest-core (CPE: cpe:2.3:a:everest:everest-core), an open-source electric vehicle charging station software stack. The root cause is CWE-121 (Stack-based Buffer Overflow) in the HomeplugMessage::setup_payload function that handles SLAC (Signal Level Attenuation Characterization) protocol messages used in ISO 15118 EV charging communications. The code uses an assert statement to validate the length parameter, but assert checks are compiled out in release builds, allowing oversized SLAC payloads to overflow a fixed ~1497-byte stack buffer via memcpy. This enables stack corruption and control flow hijacking when processing network frames containing Homeplug Green PHY messages, which are used for powerline communication establishment between electric vehicles and charging stations.

RemediationAI

Upgrade EVerest everest-core to version 2026.02.0 or later, which contains a vendor-released patch addressing the stack buffer overflow (see https://github.com/EVerest/EVerest/security/advisories/GHSA-wh8w-7cfc-gq7m). Until patching is completed, implement network segmentation to isolate charging station management networks from untrusted adjacent networks, deploy network intrusion detection systems to monitor for malformed SLAC protocol frames, and restrict physical and network access to charging infrastructure to trusted personnel only. For critical deployments, consider temporarily disabling SLAC/ISO 15118 functionality if alternative charging protocols are available, though this may impact Plug&Charge and other advanced features.