Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-68132: EVerest can crash when receiving bad power‑meter data

CVE-2025-68132 · published 9 months ago

Summary

The EVerest EV charging software may stop working if it receives a malformed power‑meter message over the serial connection. The problem exists in versions before 2025.12.0 and can be triggered by an attacker who controls that input. Updating to version 2025.12.0 resolves the issue.

What to do

Update linuxfoundation everest to version 2025.12.0 or later.

Affected software

Vendor	Product	Affected versions
linuxfoundation	everest	< 2025.12.0 `cpe:2.3:o:linuxfoundation:everest::::::::`

Original advisory text

EVerest has out-of-bounds read in DZG_GSH01 SLIP CRC parser that can crash powermeter driver

EVerest is an EV charging software stack. Prior to version 2025.12.0, `is_message_crc_correct` in the DZG_GSH01 powermeter SLIP parser reads `vec[vec.size()-1]` and `vec[vec.size()-2]` without checking that at least two bytes are present. Malformed SLIP frames on the serial link can reach `is_message_crc_correct` with `vec.size() < 2` (only via the multi-message path), causing an out-of-bounds read before CRC verification and `pop_back` underflow. Therefore, an attacker controlling the serial input can reliably crash the process. Version 2025.12.0 fixes the issue.

References

https://github.com/EVerest/everest-core/security/advisories/GHSA-79gc-m8w6-9hx5 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68132... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-68132 Vendor Advisory
https://github.com/EVerest/everest-core/commit/b8139b95144e3fe0082789b7fafe4e532... Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published21 Jan 2026

Updated3 Nov 2026

First seen6 Mar 2026

Sources

CVE-2025-68132 · NVD

CVE-2025-68132 · OSV

GHSA-79gc-m8w6-9hx5 · GHSA

Track software like this

Free during beta