PT-2026-3850 · Everest · Everest

Published 2026-01-21 · Updated 2026-01-23 · CVE-2025-68137

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.10.0

Description EVerest is an EV charging software stack. An integer overflow in the SdpPacket::parse header() function can occur when processing data. Specifically, the current buffer length can be set to 7 after an 8-byte header has been read. This results in a negative value when calculating the remaining length to read, which is then interpreted as a large positive value due to the size t data type. This can lead to an infinite loop or a stack buffer overflow, depending on whether the connection is plain TCP or TLS.

Recommendations Versions prior to 2025.10.0 should be updated to version 2025.10.0 or later.

Exploit

Fix

Infinite Loop

Buffer Overflow

Weakness Enumeration

CWE-835

CWE-120

Related Identifiers

CVE-2025-68137

GHSA-7QQ4-Q9R8-WC7W

Affected Products

Everest

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68137.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-7qq4-q9r8-wc7w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68137 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68137 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2014097510382317595 · Twitter Post
• https://twitter.com/CVEnew/status/2014061170030703065 · Twitter Post
• https://twitter.com/TheHackerWire/status/2014073960946868605 · Twitter Post
• https://twitter.com/pulsepatchio/status/2014709278674698425 · Twitter Post