Everest EUVD-2026-16218

EVerest versions prior to 2026.02.0. Attacker must simultaneously send CSMS GetLog or UpdateFirmware network request while EVSE experiences a physical fault event. AC:H indicates race condition timing difficulty. No authentication required; no user interaction needed.

Real-world risk is moderate despite the 7.0 CVSS score. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates network-accessible attack surface but high complexity (AC:H) requiring precise timing to trigger the race condition between network requests and physical hardware events. SSVC framework corroborates lower urgency: exploitation status is none, the vulnerability is not automatable (requires specific environmental conditions with concurrent CSMS commands and EVSE faults), and technical impact is partial. The unauthenticated attack vector (PR:N) is concerning for internet-exposed charging infrastructure, but the AC:H requirement significantly reduces likelihood of successful exploitation. No public exploit identified at time of analysis. The primary risk is to availability (A:H) in production EV charging networks where service disruption has safety and operational consequences, while confidentiality and integrity impacts remain limited (C:L/I:L). Organizations with air-gapped or network-segmented charging infrastructure face lower practical risk.

A remote attacker sends carefully timed CSMS GetLog or UpdateFirmware requests to an internet-exposed EV charging station while monitoring for or triggering EVSE fault conditions (e.g., through electrical manipulation or environmental stress during active charging sessions). The simultaneous processing of the network command and physical fault event triggers the race condition, corrupting the internal event queue. Successful exploitation could leak sensitive operational logs containing user charging session data, corrupt firmware update state leading to failed security patches, or crash the charging station controller causing denial of service during critical charging operations. The high attack complexity (AC:H) requires precise timing and knowledge of station operational state, but no authentication is required (PR:N) for CSMS protocol access on misconfigured deployments.