PT-2026-3752 · Everest · Everest

Published 2026-01-21 · Updated 2026-02-06 · CVE-2025-68133

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions 2025.9.0 and below

Description EVerest is an EV charging software stack susceptible to a denial-of-service condition. An attacker can exhaust the operating system's memory, leading to the termination of the module and affecting all EVSE functionality. This occurs by initiating an unlimited number of TCP connections that do not proceed to ISO 15118-2 communication. The system starts a new thread for each incoming TCP or TLS socket connection before verification, and the verification process is overly permissive.

Recommendations Update to version 2025.10.0 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-68133

GHSA-MV3W-PP85-5H7C

Affected Products

Everest

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68133.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-mv3w-pp85-5h7c · Vendor Advisory
• https://github.com/EVerest/everest-core/commit/8127b8c54b296c4dd01b356ac26763f81f76a8fd · Patch
• https://github.com/EVerest/everest-core/commit/de504f0c11069010d26767b0952739e9a400cef3 · Patch
• https://osv.dev/vulnerability/CVE-2025-68133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68133 · Security Note
• https://t.me/cveNotify/149366 · Telegram Post
• https://t.me/cveNotify/151221 · Telegram Post
• https://twitter.com/CVEnew/status/2013812113450639824 · Twitter Post
• https://twitter.com/cracbot/status/2015741550547067257 · Twitter Post
• https://t.me/CVEtracker/42648 · Telegram Post
• https://twitter.com/transilienceai/status/2013816651666346342 · Twitter Post