CVE-2025-68132
MEDIUMCVSS Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Tags
Description
EVerest is an EV charging software stack. Prior to version 2025.12.0, `is_message_crc_correct` in the DZG_GSH01 powermeter SLIP parser reads `vec[vec.size()-1]` and `vec[vec.size()-2]` without checking that at least two bytes are present. Malformed SLIP frames on the serial link can reach `is_message_crc_correct` with `vec.size() < 2` (only via the multi-message path), causing an out-of-bounds read before CRC verification and `pop_back` underflow. Therefore, an attacker controlling the serial input can reliably crash the process. Version 2025.12.0 fixes the issue.
Analysis
EVerest is an EV charging software stack. Prior to version 2025.12.0, is_message_crc_correct in the DZG_GSH01 powermeter SLIP parser reads vec[vec.size()-1] and vec[vec.size()-2] without checking that at least two bytes are present. [CVSS 4.6 MEDIUM]
Technical Context
Classified as CWE-125 (Out-of-bounds Read). Affects Everest. EVerest is an EV charging software stack. Prior to version 2025.12.0, `is_message_crc_correct` in the DZG_GSH01 powermeter SLIP parser reads `vec[vec.size()-1]` and `vec[vec.size()-2]` without checking that at least two bytes are present. Malformed SLIP frames on the serial link can reach `is_message_crc_correct` with `vec.size() < 2` (only via the multi-message path), causing an out-of-bounds read before CRC verification and `pop_back` underflow. Therefore, an attacker controlling the serial in
Affected Products
Vendor: Linuxfoundation. Product: Everest. Versions: up to 2025.12.0.
Remediation
A vendor patch is available — apply it immediately.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today