CVE-2025-68134
📋 TL;DR
This vulnerability in EVerest EV charging software allows attackers to cause denial of service by triggering assertion failures that crash individual modules. When any module crashes, the manager shuts down all other modules and exits, disrupting charging services for all users. This affects all EVerest deployments prior to version 2025.10.0.
💻 Affected Systems
- EVerest EV charging software stack
📦 What is this software?
Everest by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete shutdown of all EV charging stations managed by the vulnerable system, potentially affecting multiple locations simultaneously and causing significant service disruption.
Likely Case
Intermittent service outages affecting multiple EV charging stations when assertion failures are triggered, leading to user complaints and operational disruption.
If Mitigated
Limited impact to individual modules with proper monitoring and restart mechanisms in place, though service interruptions may still occur.
🎯 Exploit Status
Exploitation requires triggering assertion failures through normal or malformed inputs to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.10.0
Vendor Advisory: https://github.com/EVerest/everest-core/security/advisories/GHSA-cxc5-rrj5-8pf3
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Stop all EVerest services. 3. Update to version 2025.10.0 using your package manager or manual installation. 4. Restart EVerest services. 5. Verify all modules are running correctly.
🔧 Temporary Workarounds
Disable assertion failures
linuxCompile EVerest with NDEBUG flag to disable assert() function calls, though this may hide other issues.
export CFLAGS="-DNDEBUG"
./configure
make clean
make
make install
🧯 If You Can't Patch
- Implement monitoring to detect and restart crashed modules automatically.
- Isolate vulnerable systems from untrusted networks and implement strict input validation.
🔍 How to Verify
Check if Vulnerable:
Check EVerest version with: everest --version or check installed package version.Check Version:
everest --versionVerify Fix Applied:
Verify version is 2025.10.0 or later and test error conditions to ensure graceful handling instead of crashes.📡 Detection & Monitoring
Log Indicators:
- Module crash logs with assertion failure messages
- Manager shutdown logs indicating module termination
- Abnormal service restarts
Network Indicators:
- Sudden loss of connectivity to charging stations
- Unusual error responses from charging APIs
SIEM Query:
source="everest.log" AND ("assertion failed" OR "module terminated" OR "manager shutdown")