Everest EUVD-2026-16228

The CVSS v4.0 score of 5.5 with attack vector Local (AV:L) and no privileges required (PR:N) indicates a local attack context; however, the actual threat model is more nuanced. The vulnerability requires MQTT network access (not strict local-only access in practice, as MQTT brokers are network-accessible), and exploitation is straightforward-a single crafted message triggers a crash. The CVSS vector shows availability impact (VA:H) but no confidentiality or integrity impact, confirming denial of service as the sole technical impact. Exploitation Probability (E:P) is marked as Probable, indicating reasonable likelihood of real-world attack attempts. While no CISA KEV status or active exploitation-in-the-wild is confirmed in the provided data, the combination of low attack complexity, trivial exploitation mechanics, and probable exploitation probability elevates practical risk despite the moderate CVSS score. Organizations running EVerest < 2026.02.0 with network-exposed MQTT endpoints face immediate availability risk. SSVC considerations: the impact is denial of service (not data breach), but EV charging infrastructure disruption carries operational criticality for some deployments; automatable exploitation is highly likely given simple MQTT message crafting.

An attacker with network access to the MQTT broker (achievable through compromised credentials, misconfigured broker exposure, or lateral movement on a shared network) publishes a malformed session_setup message targeting an EVerest charger that has encountered an ISO15118 initialization failure (e.g., due to missing IPv6 link-local configuration). The EVSE process attempts to dereference the freed v2g_ctx pointer, triggering a segmentation fault and crashing the charger, rendering it unavailable until manual restart. No public exploit code is referenced in the available data, but exploitation requires only basic MQTT protocol knowledge and a single command, making a proof-of-concept trivial to develop.