CVE-2025-68134

EVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors frequently causes the module to crash. This is particularly critical because the manager shuts down all other modules and exits when any one of them terminates, leading to a denial of service. In a context where a manager handles multiple EVSE, this would also impact other users. Version 2025.10.0 fixes the issue.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/EVerest/everest-core/security/advisories/GHSA-cxc5-rrj5-8pf3	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:linuxfoundation:everest:*:*:*:*:*:*:*:*

History

17 Jun 2026, 09:58

Type	Values Removed	Values Added
Summary		(es) EVerest es una pila de software de carga de vehículos eléctricos. Antes de la versión 2025.10.0, el uso de la función `assert` para manejar errores frecuentemente causa que el módulo se bloquee. Esto es particularmente crítico porque el gestor apaga todos los demás módulos y sale cuando cualquiera de ellos termina, lo que lleva a una denegación de servicio. En un contexto donde un gestor maneja múltiples EVSE, esto también impactaría a otros usuarios. La versión 2025.10.0 soluciona el problema.

06 Feb 2026, 21:21

Type	Values Removed	Values Added
CPE		cpe:2.3:o:linuxfoundation:everest::::::::
References	~~() https://github.com/EVerest/everest-core/security/advisories/GHSA-cxc5-rrj5-8pf3 -~~	() https://github.com/EVerest/everest-core/security/advisories/GHSA-cxc5-rrj5-8pf3 - Vendor Advisory
First Time		Linuxfoundation Linuxfoundation everest

21 Jan 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-21 19:16

Updated : 2026-06-17 09:58

NVD link : CVE-2025-68134

Mitre link : CVE-2025-68134

CVE.ORG link : CVE-2025-68134

JSON object : View

Products Affected

linuxfoundation

everest

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-68134", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68134", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T19:03:31.722493Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "EVerest", "product": "everest-core", "versions": [{"status": "affected", "version": "< 2025.10.0"}]}]}], "published": "2026-01-21T19:16:04.510", "references": [{"url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-cxc5-rrj5-8pf3", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors frequently causes the module to crash. This is particularly critical because the manager shuts down all other modules and exits when any one of them terminates, leading to a denial of service. In a context where a manager handles multiple EVSE, this would also impact other users. Version 2025.10.0 fixes the issue."}, {"lang": "es", "value": "EVerest es una pila de software de carga de veh\u00edculos el\u00e9ctricos. Antes de la versi\u00f3n 2025.10.0, el uso de la funci\u00f3n `assert` para manejar errores frecuentemente causa que el m\u00f3dulo se bloquee. Esto es particularmente cr\u00edtico porque el gestor apaga todos los dem\u00e1s m\u00f3dulos y sale cuando cualquiera de ellos termina, lo que lleva a una denegaci\u00f3n de servicio. En un contexto donde un gestor maneja m\u00faltiples EVSE, esto tambi\u00e9n impactar\u00eda a otros usuarios. La versi\u00f3n 2025.10.0 soluciona el problema."}], "lastModified": "2026-06-17T09:58:34.623", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linuxfoundation:everest:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94E1768A-FED9-477E-A4B7-99FD10058D23", "versionEndExcluding": "2025.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}