Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-27828— EVerest: ISO15118 session_setup use-after-free can crash EVSE process

Quick assessment

Affected
EVerest everest-core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

EVerest是EVerest开源的一个电动汽车充电桩的固件。 EVerest 2026.02.0之前版本存在资源管理错误漏洞，该漏洞源于ISO15118_chargerImpl::handle_session_setup函数在ISO15118初始化失败后使用了已释放的v2g_ctx，可能导致远程崩溃。

AI Predicted 6.5 Difficulty: Easy EPSS 0.33% · P24
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-27828

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
EVerest: ISO15118 session_setup use-after-free can crash EVSE process
Source: CVE Program / CVE List V5
Vulnerability Description
EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_setup uses v2g_ctx after it has been freed when ISO15118 initialization fails (e.g., no IPv6 link-local address). The EVSE process can be crashed remotely by an attacker with MQTT access who issues a session_setup command while v2g_ctx has been released. Version 2026.02.0 contains a patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Vulnerability Title
EVerest 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
EVerest是EVerest开源的一个电动汽车充电桩的固件。 EVerest 2026.02.0之前版本存在资源管理错误漏洞，该漏洞源于ISO15118_chargerImpl::handle_session_setup函数在ISO15118初始化失败后使用了已释放的v2g_ctx，可能导致远程崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
EVerest everest-core < 2026.02.0 -

II. Public POCs for CVE-2026-27828

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-27828

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-27828 (1)

Same Patch Batch · EVerest · 2026-03-26 · 18 CVEs total

CVE-2026-22790 8.8 HIGH EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_pa
CVE-2026-22593 8.4 HIGH EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing
CVE-2026-23995 8.4 HIGH EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ
CVE-2026-33009 8.2 HIGH EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio
CVE-2026-26008 7.5 HIGH EVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferMod
CVE-2026-26074 7.0 HIGH EVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data race
CVE-2026-26073 5.9 MEDIUM EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queue
CVE-2026-27813 5.3 MEDIUM EVerest has use-after-free in auth timeout timer via race condition
CVE-2026-33015 5.2 MEDIUM EVerest has RemoteStop Bypass via BCB Toggle Session Restart
CVE-2026-33014 5.2 MEDIUM EVerest has Delayed Authorization Response Bypasses Termination After RemoteStop
CVE-2026-29044 5.0 MEDIUM EVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStar
CVE-2026-26070 4.6 MEDIUM EVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crash
CVE-2026-27814 4.2 MEDIUM EVerest EvseManager phase-switch path has unsynchronized shared-state access race conditio
CVE-2026-26071 4.2 MEDIUM EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free
CVE-2026-26072 4.2 MEDIUM EVerest has race-condition-induced std::map corruption in OCPP 1.6 evse_soc_map
CVE-2026-27815 EVerest: ISO15118 session_setup payment options overflow can corrupt EVSE state
CVE-2026-27816 EVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE state

IV. Related Vulnerabilities

Same product: everest-core
Same vendor: EVerest
Same weakness: CWE-416

V. Comments for CVE-2026-27828

No comments yet

Leave a comment