Everest CVE-2026-27815

The CVSS v4.0 score of 5.5 reflects medium severity with low attack complexity (AC:L) and no privilege requirement (PR:N), but critical scope is the local attack vector (AV:L). This creates an apparent tension: the technical impact is significant (availability and integrity violations, VA:H, VI:N per vector), yet real-world exploitability depends on local MQTT message injection capability. The attack requires an attacker to send crafted MQTT payloads to the charging system's MQTT broker, which typically operates on internal networks or localhost. No CISA KEV (Known Exploited Vulnerabilities) status was provided, and no public proof-of-concept code has been identified. Exploitation probability (EPSS) cannot be computed from the provided data, but the practical risk is elevated if MQTT brokers accept untrusted connections or are exposed to compromised co-located services. The availability impact (process crash) is automatable and requires no user interaction (UI:N). Organizations relying on EVerest in production charging networks should prioritize patching due to the ease of triggering denial-of-service conditions, even if remote code execution is not possible from this vector alone. The default-disabled schema validation is a significant aggravating factor, suggesting the vulnerability was introduced by a security-by-design regression.

An attacker with network access to the EVerest MQTT broker (e.g., a compromised service on the same charging network, or misconfigured public MQTT exposure) crafts an MQTT Cmd message with a payment_options array containing more than 2 elements. The message bypasses schema validation because it is disabled by default. When the EVerest charger processes the malformed message, the handle_session_setup function copies the oversized array into the fixed 2-element buffer, overwriting adjacent EVSE state variables or heap metadata. This causes either an immediate crash (denying charging service) or silent corruption of charging parameters, potentially disrupting multiple charging sessions. No public proof-of-concept code has been published, but exploitation is straightforward given access to the MQTT broker, requiring only crafted message generation with no special privileges or user interaction.