CVE Feed

    Dashboard / CVE / CVE-2025-68140

    CVE-2025-68140

    EVerest is an EV charging software stack. Prior to version 2025.9.0, once the validity of the received V2G message has been verified, it is checked whether the submitted session ID matches the registered one. However, if no session has been registered, the default value is 0. Therefore, a message submitted with a session ID of 0 is accepted, as it matches the registered value. This could allow unauthorized and anonymous indirect emission of MQTT messages and communication with V2G messages handlers, updating a session context. Version 2025.9.0 fixes the issue.

    Published:Jan 21, 2026
    Last Modified:Feb 6, 2026
    EPS:Jan 21, 2026
    EPSS Score:0.0002
    CVSS Score:4.3

    Affected Products

    Vendor
    Everest
    Product
    Everest-core
    Vendor
    Linuxfoundation
    Product
    Everest

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-33015 (CVSS 5.2) — EVerest is an EV charging software stack. Prior to version 2026.02.0, even immediately after CSMS performs a R…
    CVE-2026-33014 (CVSS 5.2) — EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed …
    CVE-2026-33009 (CVSS 8.2) — EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to C++ UB (pote…
    CVE-2026-29044 (CVSS 5) — EVerest is an EV charging software stack. Prior to version 2026.02.0, when WithdrawAuthorization is processed …
    CVE-2026-27828 (CVSS 5.5) — EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_set…
    CVE-2026-27816 (CVSS 5.5) — EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_…
    CVE-2026-27815 (CVSS 5.5) — EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_session…
    CVE-2026-27814 (CVSS 4.2) — EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by a…
    CVE-2026-27813 (CVSS 5.3) — EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to use-after-fr…
    CVE-2026-26074 (CVSS 7) — EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible `st…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High