High severity · published Jan 21, 2026
CVE-2025-68134
EVerest's use of assert functions can potentially lead to denial of service
7.4
CVSS
0.2%
EPSS
No
On KEV
Description
EVerest is an EV charging software stack. Prior to version 2025.10.0, the use of the `assert` function to handle errors frequently causes the module to crash. This is particularly critical because the manager shuts down all other modules and exits when any one of them terminates, leading to a denial of service. In a context where a manager handles multiple EVSE, this would also impact other users. Version 2025.10.0 fixes the issue.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
everest-core · EVerest
< 2025.10.0 · source: vendor
EV
Everest · Linuxfoundation
before 2025.10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-68134
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-68134
Vendor Advisory
https://github.com/EVerest/everest-core/security/advisories/GHSA-cxc5-rrj5-8pf3
More from everest-core
9.1
CVE-2026-27816
EVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE state
9.1
CVE-2026-27815
EVerest: ISO15118 session_setup payment options overflow can corrupt EVSE state
8.8
CVE-2026-22790
EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payload
8.3
CVE-2025-68137
EVerest's Integer Overflow and Signed to Unsigned conversion lead to either stack buffer overflow or infinite loop
7.8
CVE-2026-23995
EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ