During RemoteStop processing in EVerest pre‑2026.02.0, a delayed authorization response reinstates the authorized flag to true, which defeats the stop_transaction() check that should halt power output on a PowerOff event. This flaw allows a charging transaction to remain active even after a remote stop command has been issued. An attacker could exploit this to force the charger to continue supplying power, potentially causing unintended energy consumption and financial loss. The vulnerability involves improper authorization handling (CWE‑863).

The flaw affects the EVerest everest‑core software stack used in electric vehicle charging stations. Any installation of everest‑core released before version 2026.02.0 is vulnerable; the issue is present in all prior releases regardless of deployment platform.

The CVSS score of 5.2 indicates moderate severity, and the EPSS of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The most probable attack vector involves an entity with the ability to send RemoteStop commands through the charger’s remote management interface; this requires privileged access to the remote control system. While the risk is moderate, the ease of triggering the fault is low without such access.