« Back to list

CVE-2025-68136

Status: AnalyzedHigh (7.4)—

EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Session`, `IConnection` which open new TCP socket for the ISO15118-20 communications and registers callbacks for the created file descriptor, without closing and destroying the previous ones. Previous `Session` is not saved and the usage of an `unique_ptr` is lost, destroying connection data. Latter, if the used socket and therefore file descriptor is not the last one, it will lead to a null pointer dereference. Version 2025.10.0 fixes the issue.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

AV:A (red adyacente) sin privilegios → T1210. Creación no controlada de sockets y null pointer dereference causa DoS de recursos (T1499.004: agotamiento de conexiones). Carece de evidencia de RCE o acceso a datos.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Vulnerability ScanningThreat Intelligence ProgramPrivileged Account ManagementNetwork SegmentationFilter Network TrafficDisable or Remove Feature or Program

Affected technologies (1)

Linuxfoundation — Everest

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2025-68136",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-68136",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-21T19:46:18.038066Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "EVerest",
          "product": "everest-core",
          "versions": [
            {
              "status": "affected",
              "version": "< 2025.10.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-21T20:16:05.677",
  "references": [
    {
      "url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-4h8h-x5cp-g22r",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Session`, `IConnection` which open new TCP socket for the ISO15118-20 communications and registers callbacks for the created file descriptor, without closing and destroying the previous ones. Previous `Session` is not saved and the usage of an `unique_ptr` is lost, destroying connection data. Latter, if the used socket and therefore file descriptor is not the last one, it will lead to a null pointer dereference. Version 2025.10.0 fixes the issue."
    },
    {
      "lang": "es",
      "value": "EVerest es una pila de software de carga de VE. Antes de la versión 2025.10.0, una vez que el módulo recibe una solicitud SDP, crea un conjunto completamente nuevo de objetos como 'Session', 'IConnection' que abren un nuevo socket TCP para las comunicaciones ISO15118-20 y registra retrollamadas para el descriptor de archivo creado, sin cerrar y destruir los anteriores. La 'Session' anterior no se guarda y el uso de un 'unique_ptr' se pierde, destruyendo los datos de conexión. Posteriormente, si el socket utilizado y, por lo tanto, el descriptor de archivo no es el último, esto conducirá a una desreferenciación de puntero nulo. La versión 2025.10.0 corrige el problema."
    }
  ],
  "lastModified": "2026-06-17T09:58:34.830",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linuxfoundation:everest:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94E1768A-FED9-477E-A4B7-99FD10058D23",
              "versionEndExcluding": "2025.10.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}