PT-2026-3852 · Everest · Everest

CVE-2025-68139 · Publicado 2026-01-21 · Atualizado 2026-01-21

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions EVerest versions up to and including 2025.12.1

Description EVerest is an EV charging software stack. By default, the terminate connection on failed response setting is set to False in all versions up to and including 2025.12.1. This configuration places the responsibility for session and connection termination on the EV. Errors encountered by the module are logged but do not trigger automatic session and connection reset or termination. This could potentially be exploited by a malicious user to take advantage of other weaknesses. The terminate connection on failed response variable controls this behavior.

Recommendations Change the terminate connection on failed response setting to true.

Exploit

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2025-68139

GHSA-WQH4-PJ54-6XV9

Produtos afetados

Everest

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68139.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-wqh4-pj54-6xv9 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2014092390395421024 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-68139 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2014065998727372822 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-68139 · Nota de Segurança