CVE-2025-68141: EVerest vulnerable to null pointer dereference during DC_ChargeLoopRes document deserialization
EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a DCChargeLoopRes message that includes Receipt as well as TaxCosts, the vector <DetailedTax>taxcosts in the target Receipt structure is accessed out of bounds. This occurs in the method template <> void convert(const struct iso20dcDetailedTaxType& in, datatypes::DetailedTax& out) which leads to a null pointer dereference and causes the module to terminate. The EVerest processes and all its modules shut down, affecting all EVSE. Version 2025.10.0 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68141?
The severity of CVE-2025-68141 has not been officially rated, but the vulnerability is indicative of potential denial-of-service conditions due to null pointer dereference.
How do I fix CVE-2025-68141?
To fix CVE-2025-68141, upgrade EVerest to version 2025.10.0 or later, where the vulnerability has been addressed.
What software is affected by CVE-2025-68141?
CVE-2025-68141 affects EVerest versions prior to 2025.10.0.
What type of vulnerability is CVE-2025-68141?
CVE-2025-68141 is a null pointer dereference vulnerability that occurs during the deserialization of certain messages.
What is the impact of CVE-2025-68141?
The impact of CVE-2025-68141 could lead to application crashes, potentially causing denial of service for users of the affected software.