What is the CVSS score of EUVD-2026-16254?

EUVD-2026-16254 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Everest Core are affected by EUVD-2026-16254?

Organizations using EVerest should be aware of moderate risk from CVE-2026-33015, a incorrect authorization vulnerability rated CVSS 5.2. Attackers could gain access beyond their authorized level.. A patch is available.

Everest Core EUVD-2026-16254

| CVE-2026-33015 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-26 GitHub_M

Authentication Bypass Everest Core

5.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.2 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 17:15 euvd

EUVD-2026-16254

Analysis Generated

Mar 26, 2026 - 17:15 vuln.today

CVE Published

Mar 26, 2026 - 16:42 nvd

MEDIUM 5.2

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a RemoteStop (StopTransaction), the EVSE can return to PrepareCharging via the EV's BCB toggle, allowing session restart. This breaks the irreversibility of remote stop and can bypass operational/billing/safety controls. Version 2026.02.0 contains a patch.

AnalysisAI

EVerest charging software stack versions prior to 2026.02.0 allow EV operators to bypass remote stop commands issued by a Charging Station Management System (CSMS) by toggling the EV's Battery Control Box (BCB), causing the EVSE to return to PrepareCharging state and restart charging sessions. This circumvents billing, operational, and safety controls enforced by remote stop functionality. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	The risk profile is moderate in real-world environments but severity is amplified by intent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An EV operator at a public charging station, after being issued a RemoteStop by the CSMS (e.g., due to payment failure or session timeout), physically toggles the vehicle's Battery Control Box to reset the EVSE. Because the EVSE does not validate this toggle against the prior CSMS stop command, it transitions back to PrepareCharging and resumes charging without CSMS authorization. …
Remediation	Upgrade EVerest-core to version 2026.02.0 or later immediately. … Detailed patch versions, workarounds, and compensating controls in full report.