CVE-2026-23955

Katalog CVE

CVSS 4.2 · Medium EPSS 0,19%

Kerentanan Creation of Immutable Text Using String Concatenation pada linuxfoundation everest. Skor CVSS 3.1 4.2 (Medium) menurut github.com.

Deskripsi (NVD)

EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue.

Rincian

Terbit di NVD

21 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.2 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1046: Creation of Immutable Text Using String Concatenation

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/EVerest/everest-core/security/advisories/GHSA-px57-jx97-hrff exploit · advisory vendor