PT-2026-3844 · Unknown+1 · Dzg Gsh01 Powermeter+1

Published 2026-01-21 · Updated 2026-01-21 · CVE-2025-68132

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.12.0

Description The software, EVerest, an EV charging software stack, contains a flaw in the is message crc correct function within the DZG GSH01 powermeter SLIP parser. This function reads data from vec[vec.size()-1] and vec[vec.size()-2] without verifying that the vec vector contains at least two bytes. When malformed SLIP frames are received via the serial link, and the multi-message path is used, vec.size() can be less than 2. This leads to an out-of-bounds read before CRC verification and a pop back underflow. An attacker who can control the serial input can cause the process to crash.

Recommendations Update to version 2025.12.0 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2025-68132

GHSA-79GC-M8W6-9HX5

Affected Products

Dzg Gsh01 Powermeter

Everest

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68132.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-79gc-m8w6-9hx5 · Vendor Advisory
• https://github.com/EVerest/everest-core/commit/b8139b95144e3fe0082789b7fafe4e532ee494a1 · Patch
• https://osv.dev/vulnerability/CVE-2025-68132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68132 · Security Note
• https://t.me/CVEtracker/42685 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014074469296255170 · Twitter Post