CVE-2026-33014: EVerest has Delayed Authorization Response Bypasses Termination After RemoteStop
EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed authorization response restores authorized back to true, defeating the stoptransaction() call condition on PowerOff events. As a result, the transaction can remain open even after a remote stop. Version 2026.02.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33014?
CVE-2026-33014 is classified as a critical severity vulnerability.
How do I fix CVE-2026-33014?
To fix CVE-2026-33014, update your EVerest software to version 2026.02.0 or later.
What effect does CVE-2026-33014 have on EV charging software?
CVE-2026-33014 allows an attacker to bypass the transaction termination process during RemoteStop.
Which versions of EVerest are affected by CVE-2026-33014?
All versions of EVerest prior to 2026.02.0 are affected by CVE-2026-33014.
What is the main cause of the vulnerability in CVE-2026-33014?
The main cause of CVE-2026-33014 is a delayed authorization response restoring the transaction status, undermining the stop transaction mechanism.