CVE-2025-68141: EVerest EV Charging Stack DoS Vulnerability

CVE-2025-68141 Overview

CVE-2025-68141 is a null pointer dereference vulnerability in EVerest, an open-source EV charging software stack. Prior to version 2025.10.0, during the deserialization of a DC_ChargeLoopRes message that includes Receipt as well as TaxCosts, the vector <DetailedTax>tax_costs in the target Receipt structure is accessed out of bounds. This occurs in the method template <> void convert(const struct iso20_dc_DetailedTaxType& in, datatypes::DetailedTax& out) which leads to a null pointer dereference and causes the module to terminate. The EVerest processes and all its modules shut down, affecting all Electric Vehicle Supply Equipment (EVSE).

Critical Impact

Successful exploitation results in complete denial of service for all EV charging stations managed by the affected EVerest deployment, disrupting charging infrastructure operations.

Affected Products

• EVerest everest-core prior to version 2025.10.0
• EV charging infrastructure deployments using vulnerable EVerest versions
• ISO 15118-20 DC charging implementations within EVerest

Discovery Timeline

• 2026-01-21 - CVE-2025-68141 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2025-68141

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference) and stems from improper bounds checking during message deserialization in the EVerest charging stack. When processing ISO 15118-20 DC charging protocol messages, specifically the DC_ChargeLoopRes message type containing Receipt and TaxCosts data, the application fails to validate array bounds before accessing elements within the tax_costs vector.

The vulnerability is exploitable from an adjacent network position, requiring no authentication or user interaction. An attacker positioned on the same network as the EV charging infrastructure can craft malicious DC_ChargeLoopRes messages that trigger the out-of-bounds access, resulting in a null pointer dereference. This causes the entire EVerest process and all associated modules to crash, effectively disabling all connected EVSE units.

The scope of this vulnerability is changed (S:C in the CVSS vector), meaning the vulnerable component impacts resources beyond its security scope—in this case, all charging stations managed by the affected EVerest instance become unavailable.

Root Cause

The root cause lies in the convert template function that deserializes ISO 15118-20 DC DetailedTax data structures. The function accesses elements in the tax_costs vector without first verifying that the vector has been properly initialized or that the accessed index is within valid bounds. When a malformed or crafted DC_ChargeLoopRes message is received, the code attempts to dereference a null or invalid pointer, causing immediate process termination.

Attack Vector

The attack requires adjacent network access to the EV charging infrastructure. An attacker must be able to communicate with the EVerest system over the local network segment where ISO 15118 charging communication occurs. The attack can be executed by:

1. Establishing a position on the charging network (either physically at a charging station or through network compromise)
2. Crafting a malicious DC_ChargeLoopRes message with Receipt and TaxCosts structures designed to trigger the out-of-bounds vector access
3. Sending the crafted message to the EVerest instance
4. The deserialization routine attempts to access an invalid vector index, resulting in null pointer dereference
5. The entire EVerest process terminates, taking all EVSE offline

The vulnerability can be triggered without authentication, making it accessible to any attacker with adjacent network access.

Detection Methods for CVE-2025-68141

Indicators of Compromise

• Unexpected termination of EVerest processes or modules without clear system cause
• Crash logs showing null pointer dereference or segmentation faults in the convert function handling iso20_dc_DetailedTaxType
• Multiple simultaneous EVSE stations going offline unexpectedly
• Network traffic containing malformed DC_ChargeLoopRes messages with unusual Receipt or TaxCosts structures

Detection Strategies

• Monitor EVerest process stability and implement alerting for unexpected process terminations
• Implement network intrusion detection rules to identify malformed ISO 15118-20 DC charging messages
• Deploy application-level logging to capture deserialization errors before they result in crashes
• Use endpoint detection and response (EDR) solutions to monitor for null pointer dereference crash patterns

Monitoring Recommendations

• Enable verbose logging in EVerest to capture detailed information about incoming charging protocol messages
• Implement process monitoring with automatic restart capabilities to minimize downtime during attack attempts
• Monitor network traffic between EVs and charging stations for anomalous message patterns
• Set up alerts for simultaneous multi-station outages which may indicate exploitation attempts

How to Mitigate CVE-2025-68141

Immediate Actions Required

• Upgrade EVerest everest-core to version 2025.10.0 or later immediately
• Review network segmentation to limit access to EV charging infrastructure networks
• Implement network access controls to restrict which devices can communicate with EVerest systems
• Enable process monitoring and automatic restart mechanisms to minimize service disruption

Patch Information

EVerest version 2025.10.0 contains the fix for this vulnerability. The patch addresses the out-of-bounds vector access in the convert function by implementing proper bounds checking before accessing elements in the tax_costs vector during DC_ChargeLoopRes message deserialization.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Implement strict network segmentation to isolate EV charging infrastructure from untrusted network segments
• Deploy network-level access controls to limit which devices can communicate with EVerest systems
• Consider implementing a reverse proxy or message validation layer to filter malformed ISO 15118-20 messages before they reach EVerest
• Enable process supervision with automatic restart to minimize downtime if exploitation occurs

# Example: Network segmentation using iptables to restrict access to EVerest
# Allow only authorized IP ranges to communicate with EVerest (adjust as needed)
iptables -A INPUT -p tcp --dport 15118 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 15118 -j DROP

# Enable process monitoring with systemd restart policy
# In /etc/systemd/system/everest.service, ensure:
# Restart=always
# RestartSec=5