What’s Vulnerable › Vulnerabilities
CVE-2026-23955: EVerest vulnerable to concatenation of strings literal and integers
- Severity: medium (CVSS 4.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-01-21 · updated 2026-06-17
- Weakness: CWE-1046
Description
EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue.
Affected products
- everest-core: before 2025.9.0 — fixed in 2025.9.0
How to fix
Upgrade to a fixed version: everest-core 2025.9.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-23955 or the next vulnerability affects your stack