CVE-2025-68133: EVerest's unlimited connections can lead to DoS through operating system resource exhaustion
EVerest is an EV charging software stack. In versions 2025.9.0 and below, an attacker can exhaust the operating system's memory and cause the module to terminate by initiating an unlimited number of TCP connections that never proceed to ISO 15118-2 communication. This is possible because a new thread is started for each incoming plain TCP or TLS socket connection before any verification occurs, and the verification performed is too permissive. The EVerest processes and all its modules shut down, affecting all EVSE functionality. This issue is fixed in version 2025.10.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68133?
CVE-2025-68133 is considered critical due to its potential to cause denial of service through resource exhaustion.
How do I fix CVE-2025-68133?
To fix CVE-2025-68133, upgrade to EVerest versions above 2025.9.0 where the vulnerability has been addressed.
What systems are affected by CVE-2025-68133?
CVE-2025-68133 affects all versions of EVerest up to and including 2025.9.0.
What type of attack does CVE-2025-68133 facilitate?
CVE-2025-68133 facilitates a denial of service attack by allowing an attacker to exhaust system memory through unlimited TCP connections.
Is CVE-2025-68133 exploitable remotely?
Yes, CVE-2025-68133 is exploitable remotely, enabling attackers to initiate connections from any location.