CVE-2026-26008: EVerest DoS Vulnerability

CVE-2026-26008 Overview

CVE-2026-26008 is an out-of-bounds read vulnerability affecting EVerest, an open-source EV charging software stack. The vulnerability exists in versions prior to 2026.02.0 and stems from improper bounds checking when processing UpdateAllowedEnergyTransferModes messages received over the network from the Central System Management System (CSMS). Successful exploitation can lead to remote denial of service through application crash or potential memory corruption.

Critical Impact

Remote attackers can trigger an out-of-bounds std::vector access by sending crafted UpdateAllowedEnergyTransferModes messages, potentially crashing EV charging stations or corrupting memory in critical infrastructure systems.

Affected Products

• EVerest EV charging software stack versions prior to 2026.02.0
• EV charging stations and infrastructure utilizing vulnerable EVerest deployments
• OCPP-enabled charging systems with network-exposed CSMS interfaces

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-26008 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-26008

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read) and affects the EVerest EV charging software stack's handling of network-received configuration messages. The core issue lies in insufficient validation of the UpdateAllowedEnergyTransferModes message payload before accessing elements in a std::vector container. When the CSMS sends this message with indices or values that exceed the bounds of the internal vector, the software attempts to access memory outside the allocated buffer.

The network-accessible nature of this vulnerability is particularly concerning for critical infrastructure. EV charging stations are increasingly deployed in public and semi-public locations, and their network interfaces may be exposed to untrusted networks. An attacker who can communicate with the CSMS interface can send malformed messages without requiring authentication or user interaction.

Root Cause

The root cause is improper bounds checking on std::vector access operations when processing UpdateAllowedEnergyTransferModes messages. The vulnerable code path fails to validate that incoming index values or array sizes from the network fall within the expected range of the internal std::vector data structure. In C++, unchecked std::vector access via the subscript operator [] does not perform bounds checking, leading to undefined behavior when out-of-bounds indices are used.

Attack Vector

The attack can be executed remotely over the network by any entity capable of sending OCPP messages to the charging station's CSMS interface. The attacker crafts a malicious UpdateAllowedEnergyTransferModes message containing out-of-bounds indices or malformed data that triggers the vulnerable code path. This requires no prior authentication and no user interaction, making it a low-complexity attack that can be executed against any exposed EVerest deployment.

The vulnerability mechanism works as follows: when the EVerest software receives an UpdateAllowedEnergyTransferModes message from the network, it processes the energy transfer mode data without properly validating array boundaries. An attacker can send a message with index values exceeding the vector's allocated size, causing the application to read memory outside the intended buffer. This results in either an immediate crash (denial of service) or potential memory corruption that could have further security implications.

For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-26008

Indicators of Compromise

• Unexpected crashes or service restarts of EVerest charging station software
• Anomalous network traffic patterns to CSMS interfaces with malformed OCPP messages
• Application crash logs showing std::vector access violations or segmentation faults
• Memory corruption indicators in charging station diagnostics

Detection Strategies

• Monitor for unusual UpdateAllowedEnergyTransferModes messages with abnormal payload sizes or index values
• Implement network intrusion detection rules for malformed OCPP protocol traffic
• Deploy application crash monitoring on EV charging infrastructure
• Enable verbose logging for CSMS message processing to identify exploitation attempts

Monitoring Recommendations

• Configure alerting for repeated EVerest service crashes or restarts
• Implement network traffic analysis for OCPP communication channels
• Review charging station logs for unusual CSMS message patterns
• Deploy SentinelOne Singularity for endpoint protection on charging infrastructure management systems

How to Mitigate CVE-2026-26008

Immediate Actions Required

• Upgrade EVerest to version 2026.02.0 or later immediately
• Restrict network access to CSMS interfaces using firewall rules
• Implement network segmentation to isolate charging infrastructure from untrusted networks
• Monitor charging stations for signs of exploitation or service disruption

Patch Information

The EVerest project has released version 2026.02.0 which contains a patch addressing this vulnerability. The fix implements proper bounds checking before accessing std::vector elements when processing UpdateAllowedEnergyTransferModes messages. Organizations should upgrade to the patched version as soon as possible.

For patch details and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Restrict network access to CSMS interfaces to trusted IP addresses only
• Deploy a network firewall or application-layer gateway to filter OCPP traffic
• Implement rate limiting on CSMS communication channels to reduce attack surface
• Consider temporarily disabling remote CSMS connectivity until patching is complete

# Example: Restrict CSMS interface access using iptables
# Allow only trusted CSMS servers to communicate with charging stations
iptables -A INPUT -p tcp --dport 9000 -s trusted_csms_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -j DROP