What is the CVSS score of CVE-2026-33014?

CVE-2026-33014 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Everest are affected by CVE-2026-33014?

Organizations using EVerest should be aware of moderate risk from CVE-2026-33014, a incorrect authorization vulnerability rated CVSS 5.2. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-33014?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Everest CVE-2026-33014

EUVD-2026-16252 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-26 GitHub_M

Authentication Bypass Everest Everest Core

5.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.2 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16252

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:40 nvd

MEDIUM 5.2

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Prior to versions to 2026.02.0, during RemoteStop processing, a delayed authorization response restores authorized back to true, defeating the stop_transaction() call condition on PowerOff events. As a result, the transaction can remain open even after a remote stop. Version 2026.02.0 contains a patch.

AnalysisAI

EVerest-core prior to version 2026.02.0 fails to properly terminate EV charging transactions during remote stop operations due to a delayed authorization response that incorrectly restores the authorized flag to true, allowing transactions to remain open even after a PowerOff event triggers stop_transaction(). This authentication bypass affects EV charging infrastructure and enables continued power delivery after an operator-initiated remote stop command. A proof-of-concept exists but no public confirmation of active exploitation has been identified.

Technical ContextAI

EVerest is an open-source software stack for EV charging infrastructure. The vulnerability stems from CWE-863 (Incorrect Authorization), specifically a timing or state-management flaw in the RemoteStop authorization handling logic. When a remote stop is initiated, the system should maintain a stopped state; however, a delayed authorization response during this window restores the 'authorized' state variable to true, which acts as a precondition gate for the stop_transaction() method. This creates a logic flaw where the authorization state contradicts the actual operational intent (stop), allowing the charging transaction to persist. The affected product is EVerest-core (CPE: cpe:2.3:a:everest:everest-core:*:*:*:*:*:*:*:*), which is widely used in EV charging station implementations.

RemediationAI

Upgrade EVerest-core to version 2026.02.0 or later immediately using the official vendor release. Organizations should consult the GitHub Security Advisory (https://github.com/EVerest/EVerest/security/advisories/GHSA-43xm-5m3v-52hm) for deployment instructions and validation steps. Until patching can be completed, implement operational controls by restricting remote stop command execution to authenticated and authorized administrative users only, and conduct periodic transaction audits to verify that stopped sessions do not retain active charging state. Additionally, monitor charging infrastructure logs for anomalous authorization state transitions, particularly delayed responses to RemoteStop events that may indicate exploitation attempts.