CVE-2025-68136
📋 TL;DR
This vulnerability in EVerest EV charging software allows attackers to cause denial of service through null pointer dereference when handling SDP requests. The issue affects EV charging stations running vulnerable EVerest versions, potentially disrupting charging operations.
💻 Affected Systems
- EVerest EV charging software stack
📦 What is this software?
Everest by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for EV charging stations, preventing vehicles from charging and potentially requiring physical intervention to restore service.
Likely Case
Intermittent charging station crashes or instability during ISO15118-20 communication sessions, disrupting charging operations.
If Mitigated
Limited impact with proper network segmentation and monitoring, though service interruptions may still occur.
🎯 Exploit Status
Exploitation requires sending SDP requests to trigger the resource leak and subsequent null pointer dereference.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.10.0
Vendor Advisory: https://github.com/EVerest/everest-core/security/advisories/GHSA-4h8h-x5cp-g22r
Restart Required: Yes
Instructions:
1. Update EVerest to version 2025.10.0 or later. 2. Restart the EVerest service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Network isolation
linuxRestrict network access to EVerest services to trusted networks only
iptables -A INPUT -p tcp --dport [EVEREST_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [EVEREST_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate charging infrastructure from untrusted networks
- Deploy rate limiting and monitoring for SDP requests to detect potential exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check EVerest version: if version is earlier than 2025.10.0, system is vulnerableCheck Version:
everest --version or check package manager (apt/dnf/yum) for installed versionVerify Fix Applied:
Confirm EVerest version is 2025.10.0 or later and monitor for stable operation during charging sessions📡 Detection & Monitoring
Log Indicators:
- Multiple SDP request failures
- Unexpected process crashes or restarts
- Null pointer exception errors in logs
Network Indicators:
- Unusual volume of SDP requests
- TCP connection attempts to ISO15118-20 ports from untrusted sources
SIEM Query:
source="everest.log" AND ("null pointer" OR "segmentation fault" OR "SDP error")