CVE-2026-33015: EVerest has RemoteStop Bypass via BCB Toggle Session Restart
EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a RemoteStop (StopTransaction), the EVSE can return to PrepareCharging via the EV's BCB toggle, allowing session restart. This breaks the irreversibility of remote stop and can bypass operational/billing/safety controls. Version 2026.02.0 contains a patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33015?
CVE-2026-33015 is considered a medium severity vulnerability in EVerest that allows unauthorized session restart after a RemoteStop.
How do I fix CVE-2026-33015?
To fix CVE-2026-33015, upgrade EVerest to version 2026.02.0 or later.
Who is impacted by CVE-2026-33015?
Users running EVerest versions prior to 2026.02.0 are impacted by CVE-2026-33015.
What types of attacks can CVE-2026-33015 facilitate?
CVE-2026-33015 can facilitate unauthorized resumption of charging sessions after they have been remotely stopped.
When was CVE-2026-33015 disclosed?
CVE-2026-33015 was disclosed in 2026 and affects the EV charging software stack EVerest.