Loading story…
The open-source EV charging software stack EVerest patched two high-severity vulnerabilities in version 2026.02.0, including a stack-based buffer overflow tracked as CVE-2026-23995 and a remotely triggerable data race tracked as CVE-2026-33009. The buffer overflow affects CAN interface initialization in versions prior to 2026.02.0 when an interface name longer than IFNAMSIZ is passed to CAN open routines, overflowing ifreq.ifr_name and potentially corrupting adjacent stack memory before privilege checks occur. The issue was classified as CWE-121 and could lead to code execution, with related advisory GHSA-p47c-2jpr-mpwx.
The second flaw, CVE-2026-33009, allows remote triggering through the MQTT topic everest_external/nodered/{connector}/cmd/switch_three_phases_while_charging, where concurrent access to charger state objects can cause undefined C++ behavior, state corruption, and possible memory corruption. The vulnerability was classified as CWE-362 and carries high availability impact because it can disrupt charger operation without authentication. Both issues affect EVerest releases before 2026.02.0, and organizations running EV charging infrastructure on the platform should prioritize upgrading to the patched release and review the corresponding advisory GHSA-33qh-fg6f-jjx5.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Two new vulnerabilities in EVerest were publicly recorded: CVE-2026-23995, a stack buffer overflow in ifreq.ifr_name during CAN interface initialization, and CVE-2026-33009, a data race in MQTT switch-phases handling that can corrupt charger state. GitHub security advisories GHSA-p47c-2jpr-mpwx and GHSA-33qh-fg6f-jjx5 were referenced alongside the disclosures.
EVerest version 2026.02.0 was released with fixes for two flaws affecting earlier versions: a stack-based buffer overflow in CAN interface initialization and a remotely triggerable MQTT switch-phases data race. The patched issues were later tracked as CVE-2026-23995 and CVE-2026-33009.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
High-severity vulnerabilities were disclosed in **OpenClaw** and **CTEK Chargeportal**, with both flaws tied to insecure WebSocket handling that can let attackers gain unauthorized control. In **CVE-2026-22172**, OpenClaw versions prior to `2026.3.12` fail to properly bind authorized scopes in shared-token or password-authenticated WebSocket sessions, allowing a low-privileged user to self-assign elevated permissions such as `operator.admin` and perform admin-only gateway operations. The issue is classified as **CWE-862** and carries a CVSS v3.1 score reflecting high impact to confidentiality, integrity, and availability. In **CVE-2026-25192**, CTEK Chargeportal exposes WebSocket endpoints that do not properly authenticate critical functions, enabling an unauthenticated attacker to impersonate EV charging stations by using a known or discovered station identifier. That access can be used to send or receive **OCPP** commands as a legitimate charger, potentially leading to unauthorized control of charging infrastructure, privilege escalation, and corruption of backend charging data. The flaw is tracked as **CWE-306** and is covered in **CISA** advisory `ICSA-26-078-06`, with impact rated high for confidentiality and integrity.
Jun 29, 2026
**Siemens Heliox EV chargers** were disclosed to contain an **improper access control** weakness (CWE-923) that could allow an attacker with physical access to the charging interface to reach **unauthorized services via the charging cable**. CISA published an ICS advisory describing the issue and noting Siemens has released updated software versions; the advisory lists affected models including the **Heliox Flex 180 kW EV Charging Station** and **Heliox Mobile DC 40 kW EV Charging Station**, and scores the issue **CVSS v3.1 2.6 (Low)** with a vector indicating a **physical** attack requirement (e.g., `AV:P`). Siemens recommends updating to fixed versions and protecting device/network access per its industrial security operational guidelines. Canada’s Centre for Cyber Security also highlighted Siemens’ March 2026 advisory set, including updates for **Heliox Flex (prior to F4.11.1)** and **Heliox Mobile DC 40 (prior to L4.10.1)**, alongside unrelated Siemens product lines (e.g., Mendix, RUGGEDCOM, SIMATIC). A separate Canadian advisory covering **Schneider Electric** products (EcoStruxure and Modicon lines) is a different vendor’s disclosure and does not pertain to the Siemens Heliox EV charger vulnerability.
Jun 29, 2026
CyberDanube Security Research disclosed two high-impact vulnerabilities in **MENNEKES Amtron Series** and **Smart-T PnC** charging products running firmware `5.22.3` and earlier. **CVE-2026-8979** is an authentication bypass (`CWE-287`) that lets an unauthenticated remote attacker change a user account password by sending a crafted POST request to the `/operator/operator` endpoint, while **CVE-2026-8980** is a privilege-escalation flaw (`CWE-269`) that allows a low-privileged authenticated user to change the passwords of the admin/operator and manufacturer accounts. The flaws were published through Full Disclosure and CVE records, with CyberDanube naming S. Eisenreich-Dietz and Thomas Weber as the researchers. The advisory says the issues are fixed in firmware `5.33.11-21500` and urges operators to update to the latest firmware; where immediate patching is not possible, access to the devices should be restricted because the vulnerabilities can enable unauthorized control over charger accounts and administrative functions.
Jun 29, 2026