CVE-2025-68141 - CVE House
Back to Database
Status published High CVE-2025-68141

EVerest vulnerable to null pointer dereference during DC_ChargeLoopRes document deserialization

Vulnerability Description

EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes` message that includes Receipt as well as TaxCosts, the vector `<DetailedTax>tax_costs` in the target `Receipt` structure is accessed out of bounds. This occurs in the method `template <> void convert(const struct iso20_dc_DetailedTaxType& in, datatypes::DetailedTax& out)` which leads to a null pointer dereference and causes the module to terminate. The EVerest processes and all its modules shut down, affecting all EVSE. Version 2025.10.0 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68141

Credits & Attribution

No credits recorded in the NVD database.

References

More from EVerest

View All →
CVE-2025-68140
EVerest allows null session ID to bypass session ID verification
Medium 4.3
CVE-2025-68139
In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing
Medium 4.3
CVE-2025-68138
EVerest affected by memory exhaustion in libocpp
Medium 4.7
CVE-2025-68137
EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop
High 8.4
CVE-2025-68136
EVerest's inadequate session handling can lead to memory-related errors or exhaustion of the operating system’s file descriptors, resulting in a denial of service
High 7.4

Affected Vendor

Affected Software

everest-core
Vulnerable Versions:
< 2025.10.0

Timeline

Official Publish: January 21st, 2026
Last Modified: January 22nd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

CWE-476

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1499.004 Application or System Exploitation
Impact
T1489 Service Stop
Impact
T1203 Exploitation for Client Execution
Execution
T1190 Exploit Public-Facing Application
Initial Access