7.4

CVE-2025-68133: everest everest-core

CVSS: 7.4v3.1HighAnalyzed
Published 21-01-2026Last modified 21-01-2026
Open JSON

Vulnerability summary

CVE-2025-68133 is a high (CVSS 7.4) vulnerability in everest everest-core. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.4/10
010
High · v3.1 (CVE.org)
EPSS score
0.40%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Timeline

  1. 21-01-2026
    PublishedVulnerability first disclosed.
  2. 21-01-2026
    Last modifiedVulnerability information updated.

Description

EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new thread is started for each incoming plain TCP or TLS socket connection before any verification occurs, and the verification performed is too permissive. The EVerest processes and all its modules shut down, affecting all EVSE functionality. This issue is fixed in version 2025.10.0.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

+0.01 pp

From 0.39% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Everest Core

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Everest1 product
Linuxfoundation1 product

2 vendors · 2 products

References

3 links