Everest EUVD-2026-16226

The CVSS v4.0 base score of 5.5 with vector AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N indicates local attack vector with low complexity, no privileges or user interaction required, resulting in high availability impact (service crash) but no direct confidentiality or integrity compromise of other security domains. SSVC analysis indicates no confirmed exploitation to date, non-automatable attack (requires crafted MQTT payload with specific charger state), and partial technical impact (denial of service via crash or EVSE state corruption). The local attack vector significantly reduces real-world risk compared to remote vulnerabilities, as it requires either local network access or MQTT broker compromise. Patch availability (version 2026.02.0) further mitigates urgency. However, the default-disabled schema validation and automotive critical infrastructure context warrant elevated attention for operators managing EV charging networks, particularly those with direct internet-exposed MQTT brokers or hostile internal network assumptions.

An attacker with network access to an EVerest-Core MQTT broker (or who has compromised a legitimate MQTT client) crafts an oversized energy_transfer_modes list payload in an ISO15118 Cmd message containing more than 6 mode entries. When the charger processes this message with schema validation disabled, the handle_update_energy_transfer_modes function copies the entire list into the fixed 6-element array, overwriting adjacent EVSE state variables in memory. This causes either immediate process crash (denial of service to the charging station) or silent corruption of critical charging parameters, potentially affecting grid synchronization or vehicle charging safety. No public proof-of-concept exploit exists at this time, and successful exploitation requires either authenticated MQTT access or prior broker compromise.