Skip to main content

Everest CVE-2025-68140

MEDIUM
Incorrect Authorization (CWE-863)
2026-01-21 security-advisories@github.com
4.3
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
4.3 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 21, 2026 - 20:16 nvd
MEDIUM 4.3

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the submitted session ID matches the registered one. However, if no session has been registered, the default value is 0. Therefore, a message submitted with a session ID of 0 is accepted, as it matches the registered value. This could allow unauthorized and anonymous indirect emission of MQTT messages and communication with V2G messages handlers, updating a session context. Version 2025.9.0 fixes the issue.

AnalysisAI

EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the submitted session ID matches the registered one. [CVSS 4.3 MEDIUM]

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects Everest. EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the submitted session ID matches the registered one. However, if no session has been registered, the default value is 0. Therefore, a message submitted with a session ID of 0 is accepted, as it matches the registered value. This could allow unauthorized and anonymous indirect emission of MQTT messages and communication with V2G messages handl

RemediationAI

Monitor vendor advisories for a patch.

CVE-2025-68137 HIGH POC
8.3 Jan 21

EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse

CVE-2025-68141 HIGH POC
7.4 Jan 21

EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes`

CVE-2025-68136 HIGH POC
7.4 Jan 21

EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates

CVE-2025-68133 HIGH POC
7.4 Jan 21

EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's

CVE-2025-68135 MEDIUM POC
6.5 Jan 21

EVerest is an EV charging software stack. Prior to version 2025.10.0, C++ exceptions are not properly handled for and by

CVE-2025-68132 MEDIUM POC
4.6 Jan 21

EVerest is an EV charging software stack. Prior to version 2025.12.0, `is_message_crc_correct` in the DZG_GSH01 powermet

CVE-2026-23955 MEDIUM POC
4.2 Jan 21

Everest EV charging software prior to version 2025.9.0 contains an improper pointer arithmetic flaw in error handling wh

CVE-2025-68134 HIGH
7.4 Jan 21

EVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors

CVE-2026-24003 MEDIUM
4.3 Jan 26

EVerest is an EV charging software stack. [CVSS 4.3 MEDIUM]

CVE-2025-68139 MEDIUM
4.3 Jan 21

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminat

CVE-2026-26072 MEDIUM
4.2 Mar 26

EVerest EV charging software prior to version 2026.02.0 contains a race condition in concurrent map access that can corr

CVE-2026-26071 MEDIUM
4.2 Mar 26

EVerest EV charging software versions before 2026.02.0 contain a race condition in std::string handling triggered by con

Share

CVE-2025-68140 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy