CVE-2025-68133: falha de alta gravidade em everest-core
EVerest's unlimited connections can lead to DoS through operating system resource exhaustion
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.4epss 0.4%
EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new thread is started for each incoming plain TCP or TLS socket connection before any verification occurs, and the verification performed is too permissive. The EVerest processes and all its modules shut down, affecting all EVSE functionality. This issue is fixed in version 2025.10.0.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Produtos afetados
EVerest · everest-coreCVEs relacionadas — everest-core
No mesmo produto, das mais perigosas para as menos.
CVE-2025-68137HIGHEVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loopEPSS 1.3%CVE-2024-37310CRITICALEVerest has an integer overflow in the "v2g_incoming_v2gtp" function EPSS 0.7%CVE-2026-22790HIGHEVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payloadEPSS 0.6%CVE-2026-26008HIGHEVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModesEPSS 0.4%CVE-2025-68135MEDIUMEVerest's inadequate exception handling leads to denial of serviceEPSS 0.3%CVE-2026-26073MEDIUMEVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queueEPSS 0.3%