CVE-2025-68139

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68139", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-15T18:15:08.403Z", "datePublished": "2026-01-21T19:36:36.127Z", "dateUpdated": "2026-01-22T16:50:50.152Z"}, "containers": {"cna": {"title": "In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing", "problemTypes": [{"descriptions": [{"cweId": "CWE-384", "lang": "en", "description": "CWE-384: Session Fixation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/EVerest/everest-core/security/advisories/GHSA-wqh4-pj54-6xv9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-wqh4-pj54-6xv9"}], "affected": [{"vendor": "EVerest", "product": "everest-core", "versions": [{"version": "<= 2025.12.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T19:36:36.127Z"}, "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminate_connection_on_failed_response` is `False`, which leaves the responsibility for session and connection termination to the EV. In this configuration, any errors encountered by the module are logged but do not trigger countermeasures such as session and connection reset or termination. This could be abused by a malicious user in order to exploit other weaknesses or vulnerabilities. While the default will stay at the setting that is described as potentially problematic in this reported issue, a mitigation is available by changing the `terminate_connection_on_failed_response` setting to `true`. However this cannot be set to this value by default since it can trigger errors in vehicle ECUs requiring ECU resets and lengthy unavailability in charging for vehicles. The maintainers judge this to be a much more important workaround then short-term unavailability of an EVSE, therefore this setting will stay at the current value."}], "source": {"advisory": "GHSA-wqh4-pj54-6xv9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T15:09:46.284258Z", "id": "CVE-2025-68139", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T16:50:50.152Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68139", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T15:09:46.284258Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T15:09:47.596Z"}}], "cna": {"title": "In EVerest, by default, the EV is responsible for closing the connection if the module encounters an error during request processing", "source": {"advisory": "GHSA-wqh4-pj54-6xv9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "EVerest", "product": "everest-core", "versions": [{"status": "affected", "version": "<= 2025.12.1"}]}], "references": [{"url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-wqh4-pj54-6xv9", "name": "https://github.com/EVerest/everest-core/security/advisories/GHSA-wqh4-pj54-6xv9", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminate_connection_on_failed_response` is `False`, which leaves the responsibility for session and connection termination to the EV. In this configuration, any errors encountered by the module are logged but do not trigger countermeasures such as session and connection reset or termination. This could be abused by a malicious user in order to exploit other weaknesses or vulnerabilities. While the default will stay at the setting that is described as potentially problematic in this reported issue, a mitigation is available by changing the `terminate_connection_on_failed_response` setting to `true`. However this cannot be set to this value by default since it can trigger errors in vehicle ECUs requiring ECU resets and lengthy unavailability in charging for vehicles. The maintainers judge this to be a much more important workaround then short-term unavailability of an EVSE, therefore this setting will stay at the current value."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-384", "description": "CWE-384: Session Fixation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T19:36:36.127Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68139", "state": "PUBLISHED", "dateUpdated": "2026-01-22T16:50:50.152Z", "dateReserved": "2025-12-15T18:15:08.403Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T19:36:36.127Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "everest-core", "vendor": "EVerest", "versions": [{"status": "affected", "version": "<= 2025.12.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linuxfoundation:everest:*:*:*:*:*:*:*:*", "matchCriteriaId": "C2054B5F-AED8-4768-8D31-2B05D3CF67EC", "versionEndIncluding": "2025.12.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminate_connection_on_failed_response` is `False`, which leaves the responsibility for session and connection termination to the EV. In this configuration, any errors encountered by the module are logged but do not trigger countermeasures such as session and connection reset or termination. This could be abused by a malicious user in order to exploit other weaknesses or vulnerabilities. While the default will stay at the setting that is described as potentially problematic in this reported issue, a mitigation is available by changing the `terminate_connection_on_failed_response` setting to `true`. However this cannot be set to this value by default since it can trigger errors in vehicle ECUs requiring ECU resets and lengthy unavailability in charging for vehicles. The maintainers judge this to be a much more important workaround then short-term unavailability of an EVSE, therefore this setting will stay at the current value."}, {"lang": "es", "value": "EVerest es una pila de software de carga de veh\u00edculos el\u00e9ctricos. En todas las versiones hasta la 2025.12.1 inclusive, el valor predeterminado para `terminate_connection_on_failed_response` es `False`, lo que deja la responsabilidad de la terminaci\u00f3n de la sesi\u00f3n y la conexi\u00f3n al veh\u00edculo el\u00e9ctrico. En esta configuraci\u00f3n, cualquier error encontrado por el m\u00f3dulo se registra pero no activa contramedidas como el restablecimiento o la terminaci\u00f3n de la sesi\u00f3n y la conexi\u00f3n. Esto podr\u00eda ser abusado por un usuario malintencionado para explotar otras debilidades o vulnerabilidades. Aunque el valor predeterminado se mantendr\u00e1 en la configuraci\u00f3n que se describe como potencialmente problem\u00e1tica en este problema reportado, una mitigaci\u00f3n est\u00e1 disponible cambiando la configuraci\u00f3n de `terminate_connection_on_failed_response` a `true`. Sin embargo, esto no puede establecerse a este valor por defecto ya que puede desencadenar errores en las ECUs de los veh\u00edculos, requiriendo restablecimientos de la ECU y una prolongada indisponibilidad en la carga para los veh\u00edculos. Los mantenedores juzgan que esta es una soluci\u00f3n alternativa mucho m\u00e1s importante que la indisponibilidad a corto plazo de un EVSE, por lo tanto, esta configuraci\u00f3n se mantendr\u00e1 en el valor actual."}], "id": "CVE-2025-68139", "lastModified": "2026-06-17T09:58:35.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68139", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T15:09:46.284258Z", "version": "2.0.3"}}]}, "published": "2026-01-21T20:16:06.167", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-wqh4-pj54-6xv9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2026-01-22T10:08:42.274830+00:00", "updated": "2026-01-22T10:08:42.274856+00:00", "vendors": ["everest", "everest$PRODUCT$everest-core"]}