CVE-2025-68139: EVerest EV Charging Stack DoS Vulnerability

CVE-2025-68139 Overview

CVE-2025-68139 is a Session Fixation vulnerability (CWE-384) in EVerest, an open-source EV charging software stack. The vulnerability exists in all versions up to and including 2025.12.1, where the default configuration for terminate_connection_on_failed_response is set to False. This insecure default leaves session and connection termination responsibility entirely to the Electric Vehicle (EV), allowing potential abuse by malicious actors.

Critical Impact

A malicious user on an adjacent network could exploit this misconfiguration to maintain persistent connections despite errors, potentially enabling exploitation of additional weaknesses or vulnerabilities in the EV charging infrastructure.

Affected Products

• EVerest (all versions up to and including 2025.12.1)
• EVerest everest-core module

Discovery Timeline

• 2026-01-21 - CVE CVE-2025-68139 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2025-68139

Vulnerability Analysis

This vulnerability stems from an insecure default configuration in EVerest's connection handling mechanism. When the terminate_connection_on_failed_response setting is configured to False (the default), the EVerest charging station software fails to implement proper countermeasures when errors are encountered during EV-to-EVSE communication.

In this configuration, errors are logged but do not trigger defensive actions such as session resets or connection terminations. The session lifecycle management is delegated entirely to the connected EV, which creates a trust boundary violation. A malicious actor with adjacent network access could exploit this behavior to maintain unauthorized sessions, bypass error-handling mechanisms, and potentially chain this weakness with other vulnerabilities in the charging infrastructure.

The vulnerability is classified under CWE-384 (Session Fixation), as the improper session management allows attackers to potentially fixate or manipulate session states when the charging station fails to enforce proper session termination policies.

Root Cause

The root cause is an insecure default configuration choice where terminate_connection_on_failed_response defaults to False. This design decision was intentional by the maintainers to avoid triggering errors in certain vehicle ECUs that could result in ECU resets and extended charging unavailability. However, this trade-off creates a security gap where the EVSE (Electric Vehicle Supply Equipment) does not enforce session termination on error conditions, leaving the system vulnerable to abuse.

Attack Vector

The attack requires adjacent network access, meaning an attacker must be on the same network segment as the target EVSE. The attack complexity is low with no privileges required and no user interaction needed. An attacker could:

1. Establish a connection to a vulnerable EVerest-powered charging station
2. Trigger error conditions that would normally terminate a session
3. Maintain the connection despite errors due to the permissive default configuration
4. Use the persistent connection to probe for and exploit additional vulnerabilities

The vulnerability mechanism centers on improper session lifecycle management. When errors occur during the charging protocol, a properly secured system should terminate the session and reset the connection. However, with the default configuration, EVerest only logs these errors without taking protective action, allowing potentially malicious sessions to persist. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-68139

Indicators of Compromise

• Unusual connection persistence patterns where sessions remain active despite logged errors
• Multiple error log entries for a single connection without corresponding session terminations
• Anomalous connection behavior from specific EVs or MAC addresses showing repeated error patterns

Detection Strategies

• Monitor EVerest logs for error conditions that are not followed by session termination events
• Implement alerting on connections that exceed normal session duration thresholds
• Review configuration files to verify terminate_connection_on_failed_response settings across all deployed charging stations

Monitoring Recommendations

• Enable verbose logging on EVerest deployments to capture all session lifecycle events
• Deploy network monitoring solutions to detect anomalous traffic patterns on charging infrastructure networks
• Implement centralized log aggregation to correlate error events with session management actions across multiple EVSEs

How to Mitigate CVE-2025-68139

Immediate Actions Required

• Review current EVerest deployments to identify instances running versions up to and including 2025.12.1
• Assess the risk tolerance for your deployment environment before changing the default configuration
• Implement network segmentation to limit adjacent network access to charging infrastructure

Patch Information

No patch is currently available that changes the default behavior. The EVerest maintainers have intentionally retained the current default setting due to compatibility concerns with certain vehicle ECUs. Changing the default could cause ECU resets and extended charging unavailability for some vehicles.

The recommended mitigation is a configuration change rather than a software update. Users must manually modify the terminate_connection_on_failed_response setting in their EVerest configuration to address this vulnerability. For complete details on the security implications and mitigation options, see the GitHub Security Advisory for GHSA-wqh4-pj54-6xv9.

Workarounds

• Set terminate_connection_on_failed_response to true in the EVerest configuration (note: this may cause issues with certain vehicle ECUs)
• Implement network-level access controls to restrict which devices can communicate with EVSEs
• Deploy intrusion detection systems on charging network segments to identify potential exploitation attempts
• Consider implementing additional session timeout mechanisms at the network layer as a defense-in-depth measure

# Configuration example - Enable connection termination on failed response
# In your EVerest module configuration file, set:
terminate_connection_on_failed_response: true

# Note: Test thoroughly before production deployment
# This setting may cause ECU resets and charging unavailability on some vehicles