Everest CVE-2026-33014

The CVSS 3.1 score of 5.2 (Medium) reflects a physically proximate attack vector (AV:P) with low complexity (AC:L), no special privileges required (PR:N), and no user interaction (UI:N). However, this is a scoped integrity impact (I:H) combined with availability loss (A:L), indicating partial system compromise rather than confidentiality breach. The SSVC framework assessment identifies exploitation as 'poc' (proof-of-concept available), non-automatable, with partial technical impact, suggesting this is an intermediate-priority vulnerability. The attack vector constraint (AV:P) significantly reduces real-world exploitation risk compared to network-adjacent or network attacks, as an attacker would need physical access to or control of the charging station network. The combination of a proven POC, lower EPSS exploitation probability (implied by medium CVSS and physical vector), and lack of active CISA KEV confirmation indicates this is a legitimate but not critical priority-organizations should patch in normal maintenance windows rather than emergency protocols.

An attacker with local or network access to an EV charging station (satisfying the physical attack vector requirement) initiates a remote stop command while simultaneously delaying or manipulating the authorization response. The delayed authorization response reaches the system after the stop_transaction() precondition check, incorrectly restoring the authorized flag to true. As a result, the charging transaction remains active despite the PowerOff event, allowing continued power delivery to the vehicle or enabling billing manipulation. A proof-of-concept demonstrating this timing-based authorization bypass is publicly available, though successful exploitation requires precise control over network timing or direct access to the authorization service.