PT-2026-3856 · Everest · Everest

Published 2026-01-21 · Updated 2026-01-21 · CVE-2025-68140

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2025.9.0

Description EVerest is an EV charging software stack susceptible to a session ID validation bypass. Before version 2025.9.0, the software incorrectly handles V2G messages when no session is registered. Specifically, if no session has been registered, the session ID defaults to 0. A message submitted with a session ID of 0 is then accepted, potentially allowing unauthorized and anonymous indirect emission of MQTT messages and communication with V2G message handlers, which could lead to updates to the session context. The software checks the validity of the received V2G message and verifies if the submitted session ID matches the registered one.

Recommendations Update to version 2025.9.0 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-68140

GHSA-W385-3JWP-X47X

Affected Products

Everest

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68140.json · Exploit
• https://github.com/EVerest/everest-core/security/advisories/GHSA-w385-3jwp-x47x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68140 · Security Note
• https://twitter.com/CVEnew/status/2014065997641114062 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014084711094628567 · Twitter Post