PT-2026-3849 · Everest · Everest

CVE-2025-68136 · Publicado 2026-01-21 · Atualizado 2026-01-21

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.10.0

Description EVerest is an EV charging software stack. Prior to version 2025.10.0, the software does not properly close and destroy previous connections when receiving a Session Description Protocol (SDP) request. This results in the creation of new objects like Session and IConnection, opening new TCP sockets for ISO15118-20 communications and registering callbacks for the created file descriptor. The failure to save the previous Session and the loss of the unique ptr can lead to a null pointer dereference if the used socket is not the last one.

Recommendations Update to version 2025.10.0 or later.

Exploit

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2025-68136

GHSA-4H8H-X5CP-G22R

Produtos afetados

Everest

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68136.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-4h8h-x5cp-g22r · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-68136 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2014094950669939196 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-68136 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2014061171020529919 · Publicação no Twitter