The EVerest EV charging software stack contains a critical buffer overflow vulnerability that could lead to unauthorized code execution.

This vulnerability is a stack-based buffer overflow (CWE-121) caused by passing an interface name exceeding 16 characters to CAN open routines. The flaw is reachable by an unauthenticated attacker, as it occurs during initial interface setup before privilege checks are enforced.

The ability to trigger arbitrary code execution on an EV charging infrastructure stack poses a severe risk to operational integrity and system safety. Given the CVSS score of 8.4, this vulnerability represents a high risk that could lead to full system compromise, loss of control over charging hardware, and potential lateral movement into connected operational networks.

Immediate Action: Update the EVerest-core software to version 2026.02.0 or later immediately to incorporate the provided security patch.

Proactive Monitoring: Monitor system logs for unexpected crashes during the initialization of CAN interfaces or anomalous memory usage patterns.

Compensating Controls: Restrict access to the underlying host operating system and ensure the charging stack runs with the least privileges necessary to reduce the impact of a potential compromise.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the security and stability of EVerest-based charging systems. Security teams must prioritize updating to version 2026.02.0 across all affected deployments to eliminate the stack overflow risk. Failure to apply this update leaves the system exposed to potential code execution attacks that could be initiated without authentication.