CVE-2025-68133
📋 TL;DR
This vulnerability in EVerest EV charging software allows attackers to cause denial of service by exhausting system memory through unlimited TCP connections. Attackers can initiate connections that never proceed to proper ISO 15118-2 communication, causing all EVerest modules to terminate and disrupting EV charging functionality. All systems running vulnerable EVerest versions are affected.
💻 Affected Systems
- EVerest EV charging software stack
📦 What is this software?
Everest by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of EV charging station operations, rendering all charging functionality unavailable until manual restart.
Likely Case
Temporary denial of service affecting charging availability, requiring system restart to restore functionality.
If Mitigated
Limited impact with proper network controls and monitoring, potentially causing performance degradation but not complete failure.
🎯 Exploit Status
Exploitation requires only basic networking knowledge and tools to initiate multiple TCP connections. No authentication or special payloads needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.10.0
Vendor Advisory: https://github.com/EVerest/everest-core/security/advisories/GHSA-mv3w-pp85-5h7c
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update EVerest to version 2025.10.0 or later. 3. Restart all EVerest services. 4. Verify functionality after restart.
🔧 Temporary Workarounds
Rate limiting with firewall
linuxImplement connection rate limiting at network perimeter to prevent connection exhaustion attacks
iptables -A INPUT -p tcp --dport [EVEREST_PORT] -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport [EVEREST_PORT] -m state --state NEW -m recent --update --seconds 60 --hitcount 20 -j DROP
Network segmentation
linuxRestrict access to EVerest service to trusted networks only
iptables -A INPUT -p tcp --dport [EVEREST_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [EVEREST_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit which systems can connect to EVerest service
- Deploy monitoring and alerting for abnormal connection patterns to EVerest ports
🔍 How to Verify
Check if Vulnerable:
Check EVerest version: if running 2025.9.0 or earlier, system is vulnerableCheck Version:
Check EVerest configuration files or run 'everest --version' if availableVerify Fix Applied:
Confirm EVerest version is 2025.10.0 or later and test connection handling under load📡 Detection & Monitoring
Log Indicators:
- Rapid increase in TCP connection attempts to EVerest port
- Multiple thread creation failures or memory exhaustion warnings
- EVerest process termination logs
Network Indicators:
- High volume of TCP SYN packets to EVerest port without subsequent data exchange
- Multiple connections from single source to EVerest service
SIEM Query:
source="EVEREST" AND ("connection limit" OR "memory exhausted" OR "thread creation failed") OR dest_port=[EVEREST_PORT] AND tcp_flags="SYN" count by src_ip > 100