EvseV2G has sequence state validation bypass

Successful exploitation of CVE-2026-24003 could allow an attacker to manipulate the EV charging process without proper authentication. This could lead to unauthorized charging sessions, potentially incurring costs for the legitimate user or the charging station operator. The attacker could also potentially alter the charging parameters, leading to safety concerns or damage to the electric vehicle. While the description notes limitations preventing transitions out of the WaitingForAuthentication state, the ability to bypass authentication and manipulate state transitions represents a significant security risk.

Organizations and individuals deploying Everest-Core for EV charging infrastructure are at risk. This includes EV charging station operators, fleet managers, and users of electric vehicles who rely on these charging stations. Legacy deployments using older versions of Everest-Core are particularly vulnerable.

• linux / server: Monitor ISO 15118-2 communication logs for unexpected state transitions or authentication attempts. Use journalctl -f to observe real-time log activity.

journalctl -f | grep "state_transition" | grep "authentication"

• generic web: Monitor network traffic for unusual ISO 15118-2 requests. Use curl to test the charging endpoint and observe the response headers and body for signs of manipulation.

curl -v https://<everest-core-endpoint>/iso15118

1. 2026-01-26Disclosure

   disclosure

1. Gereserveerd2026-01-19
2. Gepubliceerd2026-01-26
3. Gewijzigd2026-01-27
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-24003 is to upgrade Everest-Core to version 2025.12.2 or later, which includes the fix for this vulnerability. If an immediate upgrade is not possible, consider implementing stricter access controls and monitoring charging sessions for suspicious activity. While specific WAF rules or proxy configurations are not detailed, monitoring for unusual ISO 15118-2 communication patterns could provide an early warning of potential exploitation attempts. After upgrading, verify the fix by attempting to initiate a charging session without proper authentication and confirming that the state verification is enforced.