Everest EUVD-2026-16220

CVSS 5.3 with attack vector Physical (AV:P) and high complexity (AC:H) indicates this is not a remote network attack; exploitation requires physical proximity to the charging station and precise timing of plug/authorization event sequences. The CVSS impact triplet (C:L/I:L/A:H) shows confidentiality and integrity are marginally affected but availability impact is high, consistent with use-after-free crashes or unpredictable behavior. The physical attack vector combined with high complexity significantly reduces real-world exploitation probability compared to network-based vulnerabilities with identical CVSS scores. However, the high availability impact and information disclosure potential make this relevant for critical charging infrastructure operators. EPSS data was not provided, but the combination of low accessibility (physical access required), high complexity (timing-dependent race condition), and vendor-released patch availability (version 2026.02.0) suggests this is a manageable risk for organizations running updated deployments.

An attacker with physical access to a charging station rapidly inserts and removes an EV plug while simultaneously submitting an RFID card read or RemoteStart authorization request. The timing causes a data race where the authorization handler deallocates the plug state structure while the plug event handler still references it, triggering a use-after-free condition that either crashes the charging controller (denial of service) or leaks heap memory containing authentication tokens or session data.