CVE-2024-37310criticalCWE-122CWE-190

CVE-2024-37310: critical vulnerability in everest-core

EVerest has an integer overflow in the "v2g_incoming_v2gtp" function

Published · Updated

Follow this CVE+ Monitor everest-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 0.7%
EVerest is an EV charging software stack. An integer overflow in the "v2g_incoming_v2gtp" function in the v2g_server.cpp implementation can allow a remote attacker to overflow the process' heap. This vulnerability is fixed in 2024.3.1 and 2024.6.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
EVerest · everest-core
Related CVEs — everest-core

In the same product, most dangerous first.

CVE-2025-68137HIGHEVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loopEPSS 1.3%CVE-2026-22790HIGHEVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payloadEPSS 0.6%CVE-2025-68133HIGHEVerest's unlimited connections can lead to DoS through operating system resource exhaustionEPSS 0.4%CVE-2026-26008HIGHEVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModesEPSS 0.4%CVE-2025-68135MEDIUMEVerest's inadequate exception handling leads to denial of serviceEPSS 0.3%CVE-2026-26073MEDIUMEVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queueEPSS 0.3%