EVerest everest-core up to 2025.12.1 terminate_connection_on_failed_response session fixiation

Summaryinfo

A vulnerability identified as critical has been detected in EVerest everest-core up to 2025.12.1. The impacted element is the function terminate_connection_on_failed_response. The manipulation leads to session fixiation. This vulnerability is traded as CVE-2025-68139. Access to the local network is required for this attack to succeed. There is no exploit available.

Detailsinfo

A vulnerability was found in EVerest everest-core up to 2025.12.1 and classified as critical. This issue affects the function terminate_connection_on_failed_response. The manipulation with an unknown input leads to a session fixiation vulnerability. Using CWE to declare the problem leads to CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminate_connection_on_failed_response` is `False`, which leaves the responsibility for session and connection termination to the EV. In this configuration, any errors encountered by the module are logged but do not trigger countermeasures such as session and connection reset or termination. This could be abused by a malicious user in order to exploit other weaknesses or vulnerabilities. While the default will stay at the setting that is described as potentially problematic in this reported issue, a mitigation is available by changing the `terminate_connection_on_failed_response` setting to `true`. However this cannot be set to this value by default since it can trigger errors in vehicle ECUs requiring ECU resets and lengthy unavailability in charging for vehicles. The maintainers judge this to be a much more important workaround then short-term unavailability of an EVSE, therefore this setting will stay at the current value.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-68139 since 12/15/2025. The exploitation is known to be easy. The attack can only be initiated within the local network. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/22/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-206320). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• EVerest

Name

• everest-core

Version

• 2025.12.0
• 2025.12.1

Website

• Product: https://github.com/EVerest/everest-core/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion