Everest CVE-2026-33015

The risk profile is moderate in real-world environments but severity is amplified by intent. CVSS 5.2 (Medium) reflects the combination of physical attack vector (AV:P), low complexity (AC:L), no privileges required (PR:N), and integrity impact (I:H) with availability degradation (A:L). The SSVC framework shows exploitation is feasible (POC available), non-automatable (requires physical access and BCB manipulation), and has partial technical impact (session restart, billing bypass). The lack of CISA KEV confirmation means no confirmed active exploitation in the wild, reducing urgency relative to the CVSS score. However, the attack is not complex once physical proximity is achieved, and the impact-bypassing CSMS stop commands and billing controls-represents a significant operational and financial risk in commercial charging networks. Organizations with high-traffic public charging infrastructure should prioritize patching; isolated or monitored installations face lower risk.

An EV operator at a public charging station, after being issued a RemoteStop by the CSMS (e.g., due to payment failure or session timeout), physically toggles the vehicle's Battery Control Box to reset the EVSE. Because the EVSE does not validate this toggle against the prior CSMS stop command, it transitions back to PrepareCharging and resumes charging without CSMS authorization. The operator's session billing is bypassed and the charging session continues indefinitely or until manual intervention occurs. A proof-of-concept for this state-machine bypass has been published, though exploitation requires physical access to the vehicle and charging connector during the charging session.