PT-2026-3850 · Everest · Everest

CVE-2025-68137 · Publicado 2026-01-21 · Atualizado 2026-01-23

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.10.0

Description EVerest is an EV charging software stack. An integer overflow in the SdpPacket::parse header() function can occur when processing data. Specifically, the current buffer length can be set to 7 after an 8-byte header has been read. This results in a negative value when calculating the remaining length to read, which is then interpreted as a large positive value due to the size t data type. This can lead to an infinite loop or a stack buffer overflow, depending on whether the connection is plain TCP or TLS.

Recommendations Versions prior to 2025.10.0 should be updated to version 2025.10.0 or later.

Exploit

Correção

Infinite Loop

Buffer Overflow

Enumeração de Fraquezas

CWE-835

CWE-120

Identificadores relacionados

CVE-2025-68137

GHSA-7QQ4-Q9R8-WC7W

Produtos afetados

Everest

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68137.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-7qq4-q9r8-wc7w · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2014097510382317595 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014061170030703065 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-68137 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2014073960946868605 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-68137 · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2014709278674698425 · Publicação no Twitter