PT-2026-3849 · Everest · Everest

Published 2026-01-21 · Updated 2026-01-21 · CVE-2025-68136

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.10.0

Description EVerest is an EV charging software stack. Prior to version 2025.10.0, the software does not properly close and destroy previous connections when receiving a Session Description Protocol (SDP) request. This results in the creation of new objects like Session and IConnection, opening new TCP sockets for ISO15118-20 communications and registering callbacks for the created file descriptor. The failure to save the previous Session and the loss of the unique ptr can lead to a null pointer dereference if the used socket is not the last one.

Recommendations Update to version 2025.10.0 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-68136

GHSA-4H8H-X5CP-G22R

Affected Products

Everest

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68136.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-4h8h-x5cp-g22r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68136 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68136 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2014094950669939196 · Twitter Post
• https://twitter.com/CVEnew/status/2014061171020529919 · Twitter Post