PT-2025-6207 · Openv2G · Openv2G

Qianyi Zhang · Published 2025-02-11 · Updated 2025-02-11 · CVE-2025-24956

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OpenV2G versions prior to 0.9.6

Description: A vulnerability has been identified in the OpenV2G EXI parsing feature, which is missing a length check when parsing X509 serial numbers. This allows an attacker to introduce a buffer overflow, leading to memory corruption.

Recommendations: For versions prior to 0.9.6, update to version 0.9.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the EXI parsing feature until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2025-24956

Affected Products

Openv2G

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-24956 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-647005.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-24956 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1889322411004137688 · Twitter Post
• https://t.me/cvedetector/17688 · Telegram Post
• https://twitter.com/CVEnew/status/1889265752273997986 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1889278594544726055 · Twitter Post