CVE-2026-24003

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24003", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T18:49:20.659Z", "datePublished": "2026-01-26T22:12:47.914Z", "dateUpdated": "2026-01-27T21:37:27.245Z"}, "containers": {"cna": {"title": "EvseV2G has sequence state validation bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/EVerest/everest-core/security/advisories/GHSA-9vv5-67cv-9crq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-9vv5-67cv-9crq"}, {"name": "https://github.com/EVerest/everest-core/blob/main/modules/EVSE/EvseV2G/iso_server.cpp#L44", "tags": ["x_refsource_MISC"], "url": "https://github.com/EVerest/everest-core/blob/main/modules/EVSE/EvseV2G/iso_server.cpp#L44"}], "affected": [{"vendor": "EVerest", "product": "everest-core", "versions": [{"version": "<= 2025.12.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-26T22:12:47.914Z"}, "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verification including authentication, and send requests that transition to forbidden states relative to the current one, thereby updating the current context with illegitimate data.cThanks to the modular design of EVerest, authorization is handled in a separate module and EVSEManager Charger internal state machine cannot transition out of the `WaitingForAuthentication` state through ISO 15118-2 communication. From this state, it was however possible through ISO 15118-2 messages which are published to the MQTT server to trick it into preparing to charge, and even to prepare to send current. The final requirement to actually send current to the EV was the closure of the contactors, which does not appear to be possible without leaving the `WaitingForAuthentication` state and leveraging ISO 15118-2 messages. As of time of publication, no fixed versions are available."}], "source": {"advisory": "GHSA-9vv5-67cv-9crq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T21:37:19.104072Z", "id": "CVE-2026-24003", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:37:27.245Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24003", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T21:37:19.104072Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:37:23.744Z"}}], "cna": {"title": "EvseV2G has sequence state validation bypass", "source": {"advisory": "GHSA-9vv5-67cv-9crq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "EVerest", "product": "everest-core", "versions": [{"status": "affected", "version": "<= 2025.12.1"}]}], "references": [{"url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-9vv5-67cv-9crq", "name": "https://github.com/EVerest/everest-core/security/advisories/GHSA-9vv5-67cv-9crq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/EVerest/everest-core/blob/main/modules/EVSE/EvseV2G/iso_server.cpp#L44", "name": "https://github.com/EVerest/everest-core/blob/main/modules/EVSE/EvseV2G/iso_server.cpp#L44", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verification including authentication, and send requests that transition to forbidden states relative to the current one, thereby updating the current context with illegitimate data.cThanks to the modular design of EVerest, authorization is handled in a separate module and EVSEManager Charger internal state machine cannot transition out of the `WaitingForAuthentication` state through ISO 15118-2 communication. From this state, it was however possible through ISO 15118-2 messages which are published to the MQTT server to trick it into preparing to charge, and even to prepare to send current. The final requirement to actually send current to the EV was the closure of the contactors, which does not appear to be possible without leaving the `WaitingForAuthentication` state and leveraging ISO 15118-2 messages. As of time of publication, no fixed versions are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-26T22:12:47.914Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24003", "state": "PUBLISHED", "dateUpdated": "2026-01-27T21:37:27.245Z", "dateReserved": "2026-01-19T18:49:20.659Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-26T22:12:47.914Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "everest-core", "vendor": "EVerest", "versions": [{"status": "affected", "version": "<= 2025.12.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linuxfoundation:everest:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2054B5F-AED8-4768-8D31-2B05D3CF67EC", "versionEndIncluding": "2025.12.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verification including authentication, and send requests that transition to forbidden states relative to the current one, thereby updating the current context with illegitimate data.cThanks to the modular design of EVerest, authorization is handled in a separate module and EVSEManager Charger internal state machine cannot transition out of the `WaitingForAuthentication` state through ISO 15118-2 communication. From this state, it was however possible through ISO 15118-2 messages which are published to the MQTT server to trick it into preparing to charge, and even to prepare to send current. The final requirement to actually send current to the EV was the closure of the contactors, which does not appear to be possible without leaving the `WaitingForAuthentication` state and leveraging ISO 15118-2 messages. As of time of publication, no fixed versions are available."}, {"lang": "es", "value": "EVerest es una pila de software de carga de veh\u00edculos el\u00e9ctricos. En versiones hasta la 2025.12.1 inclusive, es posible omitir la verificaci\u00f3n del estado de la secuencia, incluyendo la autenticaci\u00f3n, y enviar solicitudes que transicionan a estados prohibidos en relaci\u00f3n con el actual, actualizando as\u00ed el contexto actual con datos ileg\u00edtimos. Gracias al dise\u00f1o modular de EVerest, la autorizaci\u00f3n se gestiona en un m\u00f3dulo separado y la m\u00e1quina de estados interna del cargador EVSEManager no puede transicionar fuera del estado 'WaitingForAuthentication' a trav\u00e9s de la comunicaci\u00f3n ISO 15118-2. Desde este estado, sin embargo, fue posible a trav\u00e9s de mensajes ISO 15118-2 que se publican en el servidor MQTT enga\u00f1arlo para que se prepare para cargar, e incluso para que se prepare para enviar corriente. El requisito final para enviar corriente al veh\u00edculo el\u00e9ctrico fue el cierre de los contactores, lo cual no parece ser posible sin salir del estado 'WaitingForAuthentication' y aprovechar los mensajes ISO 15118-2. A la fecha de publicaci\u00f3n, no hay versiones corregidas disponibles."}], "id": "CVE-2026-24003", "lastModified": "2026-06-17T10:22:27.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24003", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T21:37:19.104072Z", "version": "2.0.3"}}]}, "published": "2026-01-26T22:15:56.513", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/EVerest/everest-core/blob/main/modules/EVSE/EvseV2G/iso_server.cpp#L44"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-9vv5-67cv-9crq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:59:21.339773+00:00", "value": {"mitigation_remediation": ["Upgrade the EVerest core module to a version newer than 2025.12.1 once a corrective release is available.", "Secure the MQTT broker by enabling TLS, configuring client authentication, and applying topic\u2011level access controls so that only authenticated and authorized clients can publish ISO\u202f15118\u20112 messages to the EVSE Manager.", "Segment the network or apply firewall rules to isolate the EVSE Manager from untrusted MQTT traffic, ensuring that only trusted local services can communicate with it, and monitor broker logs for suspicious message patterns."], "summary": {"action": "Assess Impact", "impact": "Unauthorized state transition enabling unauthenticated charging requests"}, "threat_synthesis": {"affected_systems": "The issue affects the EVerest:everest\u2011core component, specifically any installations using versions 2025.12.1 or earlier. No published patch exists at the time of release; users should ensure their deployments do not run these versions.", "description_and_impact": "EVerest core versions up to and including 2025.12.1 allow a bypass of sequence state verification, including authentication checks, which means an attacker can send ISO\u202f15118\u20112 messages that transition the EVSE Manager to forbidden states. The vulnerability permits the internal context to be updated with illegitimate data, potentially allowing a vehicle to be charged without proper authentication or authorization.", "risk_and_exploitability": "The CVSS v3.1 score is 4.3, indicating moderate severity, and the EPSS score is less than 1\u202f%, showing a very low historical exploitation probability. It is not currently listed in the CISA KEV catalog. Exploitation would require an attacker to craft ISO\u202f15118\u20112 messages that are published to the system\u2019s MQTT broker; with those messages, the EVSE can be tricked into a charging state that would normally be unreachable in the \u2018WaitingForAuthentication\u2019 state. Given the lack of a patch, the risk remains primarily to users running vulnerable versions."}}}}, "created": "2026-01-27T09:03:29.262647+00:00", "updated": "2026-04-18T15:00:03.455248+00:00", "vendors": ["everest", "everest$PRODUCT$everest-core"]}