A critical race condition in the EVerest EV charging software stack exposes systems to memory corruption and potential service disruption.

The vulnerability is a race condition (CWE-362) occurring within the shared context of the charging software. It is triggered by an unauthenticated attacker sending a crafted MQTT message to the everest_external/nodered/{connector}/cmd/switch_three_phases_while_charging topic, leading to concurrent access without proper synchronization.

The exploitation of this flaw can result in memory corruption, which typically leads to application crashes or denial of service for EV charging infrastructure. Given the CVSS score of 8.2, this represents a high-severity risk that could impede the availability of critical charging services and potentially lead to unpredictable system behavior in hardware environments.

Immediate Action: Update the EVerest everest-core software to version 2026.02.0 or later, which includes the necessary synchronization locks to prevent concurrent access issues.

Proactive Monitoring: Monitor MQTT traffic for unexpected messages directed at the switch_three_phases_while_charging command topic and review system logs for recurring segmentation faults or service restarts.

Compensating Controls: Implement strict network segmentation and access control lists (ACLs) for the MQTT broker to ensure that only authorized services can communicate with the EVerest command topics.

Public Exploit Available: Unknown.

Organizations operating EV charging infrastructure utilizing the EVerest stack must prioritize this update. The combination of unauthenticated remote access and the potential for memory corruption makes this a significant operational risk that requires immediate remediation.