What is the CVSS score of CVE-2026-33014?

CVE-2026-33014 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Everest Core are affected by CVE-2026-33014?

Organizations using EVerest should be aware of moderate risk from CVE-2026-33014, a incorrect authorization vulnerability rated CVSS 5.2. Attackers could gain access beyond their authorized level.. A patch is available.

Everest Core CVE-2026-33014

EUVD-2026-16252 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-26 GitHub_M

Authentication Bypass Everest Core

5.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.2 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16252

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:40 nvd

MEDIUM 5.2

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Prior to versions to 2026.02.0, during RemoteStop processing, a delayed authorization response restores authorized back to true, defeating the stop_transaction() call condition on PowerOff events. As a result, the transaction can remain open even after a remote stop. Version 2026.02.0 contains a patch.

AnalysisAI

EVerest-core prior to version 2026.02.0 fails to properly terminate EV charging transactions during remote stop operations due to a delayed authorization response that incorrectly restores the authorized flag to true, allowing transactions to remain open even after a PowerOff event triggers stop_transaction(). This authentication bypass affects EV charging infrastructure and enables continued power delivery after an operator-initiated remote stop command. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	The CVSS 3.1 score of 5.2 (Medium) reflects a physically proximate attack vector (AV:P) with low complexity (AC:L), no special privileges required (PR:N), and no user interaction (UI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with local or network access to an EV charging station (satisfying the physical attack vector requirement) initiates a remote stop command while simultaneously delaying or manipulating the authorization response. The delayed authorization response reaches the system after the stop_transaction() precondition check, incorrectly restoring the authorized flag to true. …
Remediation	Upgrade EVerest-core to version 2026.02.0 or later immediately using the official vendor release. … Detailed patch versions, workarounds, and compensating controls in full report.