Vulnerability Report

CVE-2025-68137

Title: Integer Overflow in EVerest

Memory Corruption

Proof Of Concept

PoC Available for CVE-2025-68137

CWE Category CWE-120
Published Date Jan 21, 2026
Modified Date Feb 06, 2026
Exploit Status Available
Score 8.3 CVSS v3.1
Exploit Probability (EPSS)
1.27%

Vulnerability Summary

CVE-2025-68137: EVerest is an EV charging software stack. Prior to version 2025.10.0, an integer overflow occurring in `SdpPacket::parse_header()` allows the current buffer length to be set to 7 after a complete header of size 8 has been read. The remaining length to read is computed using the current length subtracted by the header length which results in a negative value. This value is then interpreted as `SIZE_MAX` (or slightly less) because the expected type of the argument is `size_t`. Depending on whether the server is plain TCP or TLS, this leads to either an infinite loop or a stack buffer overflow. Version 2025.10.0 fixes the issue.

Impacted Vendors

L
linuxfoundation 1

Reference Links

https://github.com/EVerest/everest-core/security/advisories/GHSA-7qq4-q9r8-wc7w
CVSS v3.1
Source Entity [email protected]
Severity HIGH
8.3
Attack Vector
ADJACENT_NETWORK
Complexity
HIGH
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2025-68137 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/52679
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector ADJACENT_NETWORK
Complexity HIGH
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Stack

No specific products linked.