MEDIUM🇬🇧 English

CVE-2026-23955

CVSS 4.2v3.1pub. 2026-01-21upd. 2026-02-06

EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue.

oryginał EN
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

  • Linuxfoundation Everest

    OS
    Linuxfoundation
    < 2025.9.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2026-23995HIGH8.4ten sam produkt

EVerest is an EV charging software stack. Prior to version 2026.02.0, stack-based buffer overflow in CAN inter...

CVE-2026-26008HIGH7.5ten sam produkt

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access (std::vecto...

CVE-2026-22593HIGH8.4ten sam produkt

EVerest is an EV charging software stack. Prior to version 2026.02.0, an off-by-one check in IsoMux certificat...

CVE-2026-22790HIGH8.8ten sam produkt

EVerest is an EV charging software stack. Prior to version 2026.02.0, `HomeplugMessage::setup_payload` trusts ...

CVE-2026-26074HIGH7.0ten sam produkt

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `st...