What is the CVSS score of CVE-2026-33015?

CVE-2026-33015 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Everest are affected by CVE-2026-33015?

Organizations using EVerest should be aware of moderate risk from CVE-2026-33015, a incorrect authorization vulnerability rated CVSS 5.2. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-33015?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Everest CVE-2026-33015

EUVD-2026-16254 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-26 GitHub_M

Authentication Bypass Everest Everest Core

5.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.2 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 17:15 euvd

EUVD-2026-16254

Analysis Generated

Mar 26, 2026 - 17:15 vuln.today

CVE Published

Mar 26, 2026 - 16:42 nvd

MEDIUM 5.2

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a RemoteStop (StopTransaction), the EVSE can return to PrepareCharging via the EV's BCB toggle, allowing session restart. This breaks the irreversibility of remote stop and can bypass operational/billing/safety controls. Version 2026.02.0 contains a patch.

AnalysisAI

EVerest charging software stack versions prior to 2026.02.0 allow EV operators to bypass remote stop commands issued by a Charging Station Management System (CSMS) by toggling the EV's Battery Control Box (BCB), causing the EVSE to return to PrepareCharging state and restart charging sessions. This circumvents billing, operational, and safety controls enforced by remote stop functionality. A proof-of-concept exists and the vulnerability has been patched in version 2026.02.0, though the attack requires physical proximity to the charging equipment (CVSS attack vector: Physical).

Technical ContextAI

EVerest-core (cpe:2.3:a:everest:everest-core:*:*:*:*:*:*:*:*) is an open-source EV charging software stack that manages the state machine governing EVSE (Electric Vehicle Supply Equipment) charging sessions, including transitions between states such as PrepareCharging and Active charging. The vulnerability stems from insufficient validation of state transition guards after a RemoteStop command from the CSMS triggers a StopTransaction. CWE-863 (Incorrect Authorization) indicates that the EVSE does not properly enforce authorization logic to prevent unauthorized state transitions-specifically, the BCB toggle input is not validated against the previous remote stop command, allowing the EV to force a return to PrepareCharging. The CSMS remote stop mechanism is designed to be irreversible and enforce billing/safety boundaries; this flaw breaks that guarantee by allowing the EV itself to override the CSMS decision through a low-level signal.

RemediationAI

Upgrade EVerest-core to version 2026.02.0 or later immediately. This version contains the vendor-released patch that restores the irreversibility of RemoteStop by properly validating BCB toggle inputs against CSMS stop state. Until patching is feasible in production environments, implement physical security controls around charging equipment to prevent unauthorized BCB manipulation, enforce strict monitoring of CSMS RemoteStop commands and verify that charging sessions actually terminate, and consider disabling BCB-driven state transitions at the firmware level if the charging equipment supports such configuration. Review the GitHub Security Advisory (https://github.com/EVerest/EVerest/security/advisories/GHSA-pw9q-2287-cchc) for detailed deployment guidance and any interim configuration flags.