Everest EUVD-2026-16222

This vulnerability presents a moderate real-world risk with several mitigating factors. The CVSS 3.1 base score of 4.2 with attack vector Adjacent (AV:A) and High complexity (AC:H) correctly reflects that an attacker must be on the local network segment and triggering the race condition requires precise timing or multiple attempts. The SSVC decision framework from CISA indicates no confirmed exploitation (Exploitation: none), the vulnerability is not automatable (Automatable: no), and technical impact is limited to partial data corruption or service availability (Technical Impact: partial). Notably, no public exploit code or proof-of-concept has been identified. However, the vulnerability is real-data races in charging infrastructure software can cause safety-critical failures such as incorrect voltage/current application or failure to halt charging. Organizations deploying EVerest in production charging networks should prioritize patching, especially if the network is accessible to untrusted local users. The EPSS score and KEV status are not provided in the input; however, the combination of AV:A, AC:H, and no active exploitation suggests this is not an immediate critical priority for organizations with network segmentation.

An attacker on the local network segment (e.g., compromised EV or rogue charging client) repeatedly issues ac_switch_three_phases_while_charging requests during an active charging session, attempting to trigger a race condition between the request handler and the state machine loop. If timing aligns, the concurrent access to shared charging state variables could cause the state machine to enter an inconsistent state, resulting in incorrect power delivery, failure to halt charging, or temporary service unavailability. However, the high timing complexity (AC:H) and lack of a public proof-of-concept suggest this requires sustained effort or deep platform knowledge to reliably trigger.