CVE-2026-33014
EVerest has Delayed Authorization Response Bypasses Termination After RemoteStop
Summary
EVerest has Delayed Authorization Response Bypasses Termination After RemoteStop
Original description
The description as published by the source.
EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed authorization response restores authorized back to true, defeating the stop_transaction() call condition on PowerOff events. As a result, the transaction can remain open even after a remote stop. Version 2026.02.0 contains a patch.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov