Executive Summary

CVE-2026-27813 is a use-after-free vulnerability caused by a data race condition in the Everest EVSE core software, specifically in the timer callback handling within the authentication timeout logic.

The vulnerability occurs because the timer callback function is updated and accessed concurrently by multiple threads without proper synchronization. This happens when external events such as EV plug-in/unplug and authorization events (RFID, RemoteStart, OCPP) trigger overlapping operations on the timer.

Due to this race condition, the timer thread may invoke a callback function that has already been freed or overwritten, leading to undefined behavior such as crashes.

The root cause is that the timer's callback is updated in the timeout() method without locking, while the timer thread may simultaneously execute the callback, causing a data race.

This issue was fixed in version 2026.02.0 by adding proper synchronization to prevent concurrent access to the callback.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to crashes or undefined behavior in the Everest EV charging software stack during normal operation involving EV plug-in/unplug and authorization events.

Specifically, the use-after-free condition may cause the software to access invalid memory, potentially resulting in denial of service due to application crashes.

Since the vulnerability affects the authentication timeout handling, it could disrupt the authorization process for EV charging sessions, impacting availability and reliability.

The CVSS base score of 5.3 indicates a medium severity impact, with high impact on availability and low impact on confidentiality and integrity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a data race leading to a use-after-free condition in the Everest EVSE core software, triggered by concurrent EV plug-in/unplug and authorization events. Detection involves monitoring for race conditions and use-after-free errors in the software.

Tools like ThreadSanitizer (TSAN) can detect data races on the Timer::callback member, and AddressSanitizer (ASAN) can report heap-use-after-free crashes during test teardown.

Suggested commands include running the Everest EVSE software under ThreadSanitizer and AddressSanitizer to identify race conditions and memory errors. For example:

• Compile the Everest EVSE software with ThreadSanitizer enabled and run the test suite or reproduce the plug-in/unplug and authorization events to detect data races.
• Compile and run the software with AddressSanitizer to catch use-after-free errors during runtime or shutdown.
• Monitor logs for crashes or undefined behavior related to timer callbacks during authorization or plug-in events.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Everest EVSE software to version 2026.02.0 or later, which contains a patch that fixes the race condition and use-after-free vulnerability.

Until the upgrade can be applied, consider minimizing concurrent authorization and plug-in/unplug events or delaying their processing to reduce the chance of triggering the race condition.

Additionally, monitor the system for crashes or abnormal behavior related to timer callbacks and avoid running unpatched versions in production environments.

Useful 0 Not Useful 0