EVerest everest-core up to 2025.12.1 improper authentication

Summaryinfo

A vulnerability was found in EVerest everest-core up to 2025.12.1 and classified as critical. This vulnerability affects unknown code. The manipulation results in improper authentication. This vulnerability is identified as CVE-2026-24003. The attack can only be performed from the local network. There is not any exploit available.

Detailsinfo

A vulnerability was found in EVerest everest-core up to 2025.12.1. It has been classified as critical. Affected is an unknown code. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verification including authentication, and send requests that transition to forbidden states relative to the current one, thereby updating the current context with illegitimate data.cThanks to the modular design of EVerest, authorization is handled in a separate module and EVSEManager Charger internal state machine cannot transition out of the `WaitingForAuthentication` state through ISO 15118-2 communication. From this state, it was however possible through ISO 15118-2 messages which are published to the MQTT server to trick it into preparing to charge, and even to prepare to send current. The final requirement to actually send current to the EV was the closure of the contactors, which does not appear to be possible without leaving the `WaitingForAuthentication` state and leveraging ISO 15118-2 messages. As of time of publication, no fixed versions are available.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-24003 since 01/19/2026. The exploitability is told to be easy. The attack needs to be initiated within the local network. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 02/17/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-4652). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• EVerest

Name

• everest-core

Version

• 2025.12.0
• 2025.12.1

Website

• Product: https://github.com/EVerest/everest-core/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion