CVE-2026-23955

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23955", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T14:49:06.312Z", "datePublished": "2026-01-21T19:25:12.104Z", "dateUpdated": "2026-01-21T19:53:57.098Z"}, "containers": {"cna": {"title": "EVerest vulnerable to concatenation of strings literal and integers", "problemTypes": [{"descriptions": [{"cweId": "CWE-1046", "lang": "en", "description": "CWE-1046: Creation of Immutable Text Using String Concatenation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/EVerest/everest-core/security/advisories/GHSA-px57-jx97-hrff", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-px57-jx97-hrff"}], "affected": [{"vendor": "EVerest", "product": "everest-core", "versions": [{"version": "< 2025.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T19:25:12.104Z"}, "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue."}], "source": {"advisory": "GHSA-px57-jx97-hrff", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-21T19:53:45.367515Z", "id": "CVE-2026-23955", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T19:53:57.098Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23955", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T19:53:45.367515Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T19:53:51.057Z"}}], "cna": {"title": "EVerest vulnerable to concatenation of strings literal and integers", "source": {"advisory": "GHSA-px57-jx97-hrff", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "EVerest", "product": "everest-core", "versions": [{"status": "affected", "version": "< 2025.9.0"}]}], "references": [{"url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-px57-jx97-hrff", "name": "https://github.com/EVerest/everest-core/security/advisories/GHSA-px57-jx97-hrff", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1046", "description": "CWE-1046: Creation of Immutable Text Using String Concatenation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T19:25:12.104Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23955", "state": "PUBLISHED", "dateUpdated": "2026-01-21T19:53:57.098Z", "dateReserved": "2026-01-19T14:49:06.312Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T19:25:12.104Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "everest-core", "vendor": "EVerest", "versions": [{"status": "affected", "version": "< 2025.9.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linuxfoundation:everest:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1D746C7-49D6-43DE-90B2-C79F58ADB9B7", "versionEndExcluding": "2025.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue."}, {"lang": "es", "value": "EVerest es una pila de software de carga de VE. Antes de la versi\u00f3n 2025.9.0, en varios lugares, los valores enteros se concatenan a cadenas literales al lanzar errores. Esto resulta en aritm\u00e9tica de punteros en lugar de imprimir el valor entero como se espera, como la mayor\u00eda de los lenguajes interpretados. Esto puede ser utilizado por un operador malicioso para leer regiones de memoria no intencionadas, incluyendo el mont\u00f3n y la pila. La versi\u00f3n 2025.9.0 corrige el problema."}], "id": "CVE-2026-23955", "lastModified": "2026-06-17T10:22:20.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23955", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-21T19:53:45.367515Z", "version": "2.0.3"}}]}, "published": "2026-01-21T20:16:12.517", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-px57-jx97-hrff"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1046"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:33:01.916560+00:00", "value": {"mitigation_remediation": ["Upgrade EVerest everest-core to version 2025.9.0 or later", "Restrict operator privileges so only authorized personnel can trigger error paths", "Enable and monitor detailed error logs to detect unexpected memory read attempts and investigate promptly"], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects EVerest everest-core on the Linux Foundation EV charging platform, specifically all versions released prior to 2025.9.0. Upgrading to 2025.9.0 or later eliminates the affected code path.", "description_and_impact": "EVerest is an electric vehicle charging software stack. In releases before 2025.9.0, the code concatenates literal strings with integer values when throwing errors. This incorrect concatenation causes pointer arithmetic instead of printing the integer, enabling a malicious operator to read unintended memory regions such as the stack or heap. This can expose sensitive data or facilitate further exploitation.", "risk_and_exploitability": "The CVSS score of 4.2 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers would need to be an operator or otherwise able to trigger error conditions that exercise the vulnerable string concatenation; once achieved, they can read arbitrary memory. While the impact does not provide direct remote code execution, the information disclosure risk could aid lateral movement or credential compromise if privileged data is leaked."}}}}, "created": "2026-01-22T10:08:26.807738+00:00", "updated": "2026-04-18T15:45:04.266342+00:00", "vendors": ["everest", "everest$PRODUCT$everest-core"]}