CVE-2025-68133

HIGH

7.4

Description

EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new thread is started for each incoming plain TCP or TLS socket connection before any verification occurs, and the verification performed is too permissive. The EVerest processes and all its modules shut down, affecting all EVSE functionality. This issue is fixed in version 2025.10.0.

Details CVE

Score CVSS v3.17.4

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Vecteur d'attaqueADJACENT_NETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie1/21/2026

Derniere modification2/6/2026

Sourcenvd

Observations honeypot0

Produits affectes

linuxfoundation:everest

Faiblesses (CWE)

CWE-770

References

https://github.com/EVerest/everest-core/commit/8127b8c54b296c4dd01b356ac26763f81f76a8fd(security-advisories@github.com)

https://github.com/EVerest/everest-core/commit/de504f0c11069010d26767b0952739e9a400cef3(security-advisories@github.com)

https://github.com/EVerest/everest-core/security/advisories/GHSA-mv3w-pp85-5h7c(security-advisories@github.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.