PT-2026-3856 · Everest · Everest

CVE-2025-68140 · Publicado 2026-01-21 · Atualizado 2026-01-21

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.9.0

Description EVerest is an EV charging software stack susceptible to a session ID validation bypass. Before version 2025.9.0, the software incorrectly handles V2G messages when no session is registered. Specifically, if no session has been registered, the session ID defaults to 0. A message submitted with a session ID of 0 is then accepted, potentially allowing unauthorized and anonymous indirect emission of MQTT messages and communication with V2G message handlers, which could lead to updates to the session context. The software checks the validity of the received V2G message and verifies if the submitted session ID matches the registered one.

Recommendations Update to version 2025.9.0 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2025-68140

GHSA-W385-3JWP-X47X

Produtos afetados

Everest

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68140.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-w385-3jwp-x47x · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2014065997641114062 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2014084711094628567 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-68140 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-68140 · Nota de Segurança