8.2Yüksek
CVE-2026-33009EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio
Açıklama
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (potential memory corruption). This is triggered by an MQTT `everest_external/nodered/{connector}/cmd/switch_three_phases_while_charging` message and results in `Charger::shared_context` / `internal_context` accessed concurrently without lock. Version 2026.02.0 contains a patch.
Zayıflık türü (CWE):
CWE-362
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| EVerest | everest-core | < 2026.02.0 | |
| linuxfoundation | everest | < 2026.02.0 |
Kaynaklar ve yamalar
- https://github.com/EVerest/EVerest/security/advisories/GHSA-33qh-fg6f-jjx5 ExploitVendor Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:o:linuxfoundation:everest:*:*:*:*:*:*:*:*< 2026.02.0