PT-2026-3857 · Everest · Everest

CVE-2025-68141 · Publicado 2026-01-21 · Atualizado 2026-01-21

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.10.0

Description EVerest is an EV charging software stack. Prior to version 2025.10.0, an out-of-bounds access issue exists during the deserialization of a DC ChargeLoopRes message containing Receipt and TaxCosts. Specifically, the vector <DetailedTax>tax costs within the Receipt structure is accessed improperly in the convert function, leading to a null pointer dereference and termination of the EVerest processes and associated modules, impacting all EVSE.

Recommendations Update to version 2025.10.0 or later.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2025-68141

GHSA-PH4W-R9Q8-VM9H

Produtos afetados

Everest

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68141.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-ph4w-r9q8-vm9h · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-68141 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2014087270635048973 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014081579828514935 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-68141 · Nota de Segurança