PT-2026-3852 · Everest · Everest

Published 2026-01-21 · Updated 2026-01-21 · CVE-2025-68139

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions EVerest versions up to and including 2025.12.1

Description EVerest is an EV charging software stack. By default, the terminate connection on failed response setting is set to False in all versions up to and including 2025.12.1. This configuration places the responsibility for session and connection termination on the EV. Errors encountered by the module are logged but do not trigger automatic session and connection reset or termination. This could potentially be exploited by a malicious user to take advantage of other weaknesses. The terminate connection on failed response variable controls this behavior.

Recommendations Change the terminate connection on failed response setting to true.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2025-68139

GHSA-WQH4-PJ54-6XV9

Affected Products

Everest

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68139.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-wqh4-pj54-6xv9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68139 · Security Note
• https://twitter.com/VulmonFeeds/status/2014092390395421024 · Twitter Post
• https://twitter.com/CVEnew/status/2014065998727372822 · Twitter Post