Everest CVE-2026-26008

Remote unauthenticated attacker sending crafted UpdateAllowedEnergyTransferModes messages to EVerest versions prior to 2026.02.0. No user interaction required. Affects default EV charging configurations receiving CSMS network communications.

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates high availability impact from network-based unauthenticated attack with low complexity. However, SSVC framework assessment provides important context: exploitation status is 'none', automatable is 'no' (suggesting manual exploit development required), and technical impact is 'partial'. These signals indicate moderate real-world risk despite high CVSS score. The lack of confidentiality or integrity impact limits damage to denial of service scenarios. Attack requires adversary to either compromise CSMS infrastructure or position themselves to send OCPP messages to charging stations. EUVD tracking (EUVD-2026-16201) confirms European regulatory monitoring. Primary risk is operational disruption of EV charging infrastructure rather than data breach or lateral movement. Priority should be high for critical infrastructure operators but lower than remote code execution vulnerabilities with active exploitation.

An attacker with network access to the charging station's OCPP communication channel (either by compromising the legitimate CSMS infrastructure or positioning as a rogue CSMS on the network) sends malformed UpdateAllowedEnergyTransferModes messages with out-of-bounds vector indices. The everest-core software attempts to access invalid memory locations, resulting in immediate software crash and denial of service for the charging station, preventing legitimate EV charging operations. In memory corruption scenarios, repeated exploitation could potentially lead to undefined behavior affecting charging station reliability and requiring manual restart or intervention.