CVE-2025-68133 - CVE House

Back to Database

Status published High CVE-2025-68133

EVerest's unlimited connections can lead to DoS through operating system resource exhaustion

7.4 CVSS

Vulnerability Description

EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new thread is started for each incoming plain TCP or TLS socket connection before any verification occurs, and the verification performed is too permissive. The EVerest processes and all its modules shut down, affecting all EVSE functionality. This issue is fixed in version 2025.10.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68133

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from EVerest

View All →

EVerest vulnerable to null pointer dereference during DC_ChargeLoopRes document deserialization

EVerest allows null session ID to bypass session ID verification

In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing

EVerest affected by memory exhaustion in libocpp

EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop

Affected Vendor

EVerest

View all reports →

Affected Software

everest-core

Vulnerable Versions:

< 2025.10.0

Timeline

Official Publish: January 21st, 2026

Last Modified: January 21st, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1498 Network Denial of Service

T1190 Exploit Public-Facing Application

T1562 Impair Defenses

Defense Evasion

T1046 Network Service Discovery