CVE-2025-68136 - CVE House
Back to Database
Status published High CVE-2025-68136

EVerest's inadequate session handling can lead to memory-related errors or exhaustion of the operating system’s file descriptors, resulting in a denial of service

Vulnerability Description

EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Session`, `IConnection` which open new TCP socket for the ISO15118-20 communications and registers callbacks for the created file descriptor, without closing and destroying the previous ones. Previous `Session` is not saved and the usage of an `unique_ptr` is lost, destroying connection data. Latter, if the used socket and therefore file descriptor is not the last one, it will lead to a null pointer dereference. Version 2025.10.0 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68136

Credits & Attribution

No credits recorded in the NVD database.

References

More from EVerest

View All →
CVE-2025-68141
EVerest vulnerable to null pointer dereference during DC_ChargeLoopRes document deserialization
High 7.4
CVE-2025-68140
EVerest allows null session ID to bypass session ID verification
Medium 4.3
CVE-2025-68139
In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing
Medium 4.3
CVE-2025-68138
EVerest affected by memory exhaustion in libocpp
Medium 4.7
CVE-2025-68137
EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop
High 8.4

Affected Vendor

Affected Software

everest-core
Vulnerable Versions:
< 2025.10.0

Timeline

Official Publish: January 21st, 2026
Last Modified: January 21st, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery