Everest CVE-2026-29044

This vulnerability presents moderate real-world risk despite a CVSS score of 5.0 (Medium). The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:L) indicates network attack vector with high complexity and high privilege requirement, significantly limiting the threat surface. The SSVC decision framework assessment (Exploitation: poc, Automatable: no, Technical Impact: partial) confirms that while proof-of-concept code exists, the attack is not automatable and requires precise timing and high-privilege credentials, reducing the likelihood of opportunistic exploitation. No CISA KEV status indicating active in-the-wild exploitation is provided. The integrity impact (I:H) is the primary concern, affecting the assurance of charging authorization revocation, while the availability impact (A:L) is limited. For EV charging infrastructure operators, this poses a business logic and billing integrity risk rather than a critical system availability threat. Organizations operating EVerest-core should prioritize patching but this does not constitute an emergency-level incident.

A high-privilege operator or compromised management system sends a WithdrawAuthorization message to a charging station running vulnerable EVerest-core. Due to race-condition timing, the message arrives before the TransactionStarted event is generated. The AuthHandler evaluates transaction_active=false and invokes only withdraw_authorization_callback() without issuing a StopTransaction command. When the vehicle subsequently initiates the charging transaction moments later, the authorization withdrawal is no longer enforced, allowing the charging session to proceed. The attacker continues to charge the vehicle while circumventing billing or access controls. Exploitation requires network access and high-privilege credentials, but the proof-of-concept demonstrates feasibility under controlled timing conditions.