Everest CVE-2025-68141
HIGHCVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionNVD
EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a DC_ChargeLoopRes message that includes Receipt as well as TaxCosts, the vector <DetailedTax>tax_costs in the target Receipt structure is accessed out of bounds. This occurs in the method template <> void convert(const struct iso20_dc_DetailedTaxType& in, datatypes::DetailedTax& out) which leads to a null pointer dereference and causes the module to terminate. The EVerest processes and all its modules shut down, affecting all EVSE. Version 2025.10.0 fixes the issue.
AnalysisAI
EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a DC_ChargeLoopRes message that includes Receipt as well as TaxCosts, the vector <DetailedTax>tax_costs in the target Receipt structure is accessed out of bounds. [CVSS 7.4 HIGH]
Technical ContextAI
Classified as CWE-476 (NULL Pointer Dereference). Affects Everest. EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a DC_ChargeLoopRes message that includes Receipt as well as TaxCosts, the vector <DetailedTax>tax_costs in the target Receipt structure is accessed out of bounds. This occurs in the method template <> void convert(const struct iso20_dc_DetailedTaxType& in, datatypes::DetailedTax& out) which leads to a null pointer dereference and causes the module to terminate. The EVerest processes and al
RemediationAI
Monitor vendor advisories for a patch.
Share
External POC / Exploit Code
Leaving vuln.today