Everest EUVD-2026-16197

EVerest versions before 2026.02.0 compiled in release mode without assert checks. Attacker must be on same local network (AV:A) to send crafted oversized SLAC protocol frames to the EV charging software. No authentication or victim interaction required.

This represents a genuine high-severity risk with CVSS score 8.8 requiring immediate attention for deployed EV charging infrastructure. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates adjacent network access is required (not remote internet), low attack complexity, no privileges required, and total technical impact across confidentiality, integrity, and availability. SSVC framework assessment confirms proof-of-concept exploit code exists, technical impact is total, but exploitation is not automatable, requiring attacker proximity to the charging station network. The adjacent network requirement significantly reduces attack surface compared to remote vulnerabilities, as attackers must be on the same local network segment (potentially via physical proximity to charging infrastructure or compromise of station network). The vulnerability is particularly concerning in public charging deployments where network isolation may be weak, though the need for adjacent access prevents mass internet-based exploitation.

An attacker with adjacent network access to an EV charging station network (such as via compromised station WiFi, physical Ethernet connection, or powerline communication access) crafts malicious SLAC protocol frames with oversized payload length values. When the vulnerable HomeplugMessage::setup_payload function processes these frames in a release build, the unchecked memcpy operation overflows the stack buffer, allowing the attacker to overwrite return addresses and inject shellcode to gain arbitrary code execution on the charging station controller. SSVC analysis confirms publicly available exploit code exists, lowering the technical barrier for exploitation.