A critical stack-based buffer overflow vulnerability in the EVerest charging software stack allows unauthenticated remote attackers to achieve arbitrary code execution.

The vulnerability exists in the HomeplugMessage::setup_payload function, where an unchecked length parameter allows oversized SLAC payloads to overflow a stack buffer. This flaw is reachable by an unauthenticated attacker sending crafted network frames to the charging stack.

The ability for an unauthenticated attacker to execute arbitrary code on charging infrastructure poses a severe threat to operational integrity and safety. Successful exploitation can lead to total system compromise, potentially resulting in unauthorized control over charging sessions, denial of service, or lateral movement into connected network segments. With a CVSS score of 8.8, this vulnerability represents a high-risk entry point that necessitates immediate remediation.

Immediate Action: Update the EVerest everest-core software to version 2026.02.0 or later to ensure the buffer overflow protection is correctly implemented.

Proactive Monitoring: Monitor network traffic for malformed SLAC frames or unexpected payload sizes directed at the charging stack interfaces.

Compensating Controls: Implement strict network segmentation to isolate EV charging controllers from critical management networks, and utilize intrusion detection systems to identify anomalous traffic patterns associated with buffer overflow attempts.

Public Exploit Available: No — there is no confirmed public exploit available.

Given the potential for remote code execution and the confirmed existence of proof-of-concept material, organizations deploying EVerest software should prioritize patching as a critical security task. Failure to update to version 2026.02.0 leaves charging infrastructure exposed to reliable exploitation. Security teams must verify version deployment across all charging controllers and apply the vendor-supplied fix immediately to mitigate this risk.