CVE-2025-68141

Katalog CVE

CVSS 7.4 · High EPSS 0,27%

Kerentanan NULL Pointer Dereference pada linuxfoundation everest. Skor CVSS 3.1 7.4 (High) menurut github.com.

Deskripsi (NVD)

EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes` message that includes Receipt as well as TaxCosts, the vector `<DetailedTax>tax_costs` in the target `Receipt` structure is accessed out of bounds. This occurs in the method `template <> void convert(const struct iso20_dc_DetailedTaxType& in, datatypes::DetailedTax& out)` which leads to a null pointer dereference and causes the module to terminate. The EVerest processes and all its modules shut down, affecting all EVSE. Version 2025.10.0 fixes the issue.

Rincian

Terbit di NVD

21 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.4 (High), sumber github.com
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/EVerest/everest-core/security/advisories/GHSA-ph4w-r9q8-vm9h exploit · advisory vendor