Everest EUVD-2026-16199

Local attacker with ability to configure or pass interface names to EVerest CAN initialization routines (versions before 2026.02.0). Requires interface name exceeding 16 characters (IFNAMSIZ limit). No authentication or user interaction needed. Affects systems where attacker controls CAN interface configuration.

Real-world risk is moderate-to-high despite the 8.4 CVSS score. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates local attack vector with low complexity and no privileges required, enabling straightforward exploitation by attackers with local access. SSVC framework assessment confirms proof-of-concept exploit code exists and rates technical impact as total, though exploitation is not automatable, requiring manual configuration of malicious interface names. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation in the wild. However, the combination of POC availability, unauthenticated access requirement (PR:N), and deployment in critical EV charging infrastructure elevates priority. The local attack vector limits remote exploitation scenarios but remains concerning in shared-access or physically accessible charging station deployments where attackers can influence configuration files or startup parameters.

An attacker with local access to an EV charging station running vulnerable EVerest software modifies the system configuration file or environment variables to specify a CAN interface name exceeding 16 characters (e.g., 'can-interface-with-very-long-malicious-name'). When the EVerest service initializes, the oversized name overflows the stack buffer in the CAN open routine, overwriting adjacent memory with attacker-controlled data including shellcode or return-address pointers. Because this occurs before privilege checks with no user interaction required (PR:N, UI:N), the attacker achieves code execution with the privileges of the EVerest process, potentially gaining full control over the charging station. Publicly available exploit code exists, lowering the technical barrier for exploitation.