PT-2024-27469 · Everest · Everest

Shaqed · Published 2024-07-10 · Updated 2024-12-16 · CVE-2024-37310

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2024.3.1 EVerest versions prior to 2024.6.0

Description EVerest is an EV charging software stack. An integer overflow in the v2g incoming v2gtp function in the v2g server.cpp implementation can allow a remote attacker to overflow the process' heap.

Recommendations For versions prior to 2024.3.1, update to version 2024.3.1 or later. For versions prior to 2024.6.0, update to version 2024.6.0 or later. As a temporary workaround, consider disabling the v2g incoming v2gtp function until a patch is available.

Exploit

Fix

Integer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-190

CWE-122

Related Identifiers

CVE-2024-37310

GHSA-8G9Q-7QR9-VC96

Affected Products

Everest

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37310.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-37310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37310 · Security Note
• https://github.com/EVerest/everest-core/releases/tag/2024.3.1 · Note
• https://github.com/EVerest/everest-core/releases/tag/2024.6.0 · Note
• https://github.com/EVerest/everest-core/commit/f73620c4c0f626e1097068a47e10cc27b369ad8e · Note
• https://github.com/EVerest/everest-core/security/advisories/GHSA-8g9q-7qr9-vc96 · Note
• https://twitter.com/CVEnew/status/1811322700415279117 · Twitter Post
• https://t.me/cvedetector/588 · Telegram Post
• https://plaxidityx.com/blog/automotive-cyber-security/ev-cyber-security-plaxidityx-discovers-critical-vulnerability-in-everest-open-source-ev-charging-firmware-stack-cve-2024-37310 · Note
• https://twitter.com/VulmonFeeds/status/1811169883024994473 · Twitter Post
• https://twitter.com/CveFindCom/status/1811128665712820586 · Twitter Post
• https://t.me/cvenotify/104339 · Telegram Post