CVE-2025-68132: EVerest has out-of-bounds read in DZG_GSH01 SLIP CRC parser that can crash powermeter driver
EVerest is an EV charging software stack. Prior to version 2025.12.0, ismessagecrccorrect in the DZGGSH01 powermeter SLIP parser reads vec[vec.size()-1] and vec[vec.size()-2] without checking that at least two bytes are present. Malformed SLIP frames on the serial link can reach ismessagecrccorrect with vec.size() < 2 (only via the multi-message path), causing an out-of-bounds read before CRC verification and popback underflow. Therefore, an attacker controlling the serial input can reliably crash the process. Version 2025.12.0 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68132?
CVE-2025-68132 is classified as a high severity vulnerability due to its potential to cause crashes in the powermeter driver.
How do I fix CVE-2025-68132?
To fix CVE-2025-68132, update EVerest to version 2025.12.0 or later.
What type of vulnerability is CVE-2025-68132?
CVE-2025-68132 is an out-of-bounds read vulnerability in the DZG_GSH01 SLIP CRC parser.
What systems are affected by CVE-2025-68132?
CVE-2025-68132 affects all versions of EVerest prior to 2025.12.0.
What can happen if CVE-2025-68132 is exploited?
Exploitation of CVE-2025-68132 can lead to crashes in the powermeter driver, potentially disrupting EV charging operations.