CVE-2025-68141

EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a `DC_ChargeLoopRes` message that includes Receipt as well as TaxCosts, the vector `<DetailedTax>tax_costs` in the target `Receipt` structure is accessed out of bounds. This occurs in the method `template <> void convert(const struct iso20_dc_DetailedTaxType& in, datatypes::DetailedTax& out)` which leads to a null pointer dereference and causes the module to terminate. The EVerest processes and all its modules shut down, affecting all EVSE. Version 2025.10.0 fixes the issue.

• CWE-476

• https://github.com/EVerest/everest-core/security/advisories/GHSA-ph4w-r9q8-vm9hExploit, Vendor Advisory

Published

Jan 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68136EVerest is an EV charging software stack. Prior to version 2…7.4
• CVE-2025-68137EVerest is an EV charging software stack. Prior to version 2…8.3
• CVE-2025-68138EVerest is an EV charging software stack, and EVerest libocp…4.7
• CVE-2025-68139EVerest is an EV charging software stack. In all versions up…4.3
• CVE-2025-6814The Booking X plugin for WordPress is vulnerable to unauthor…7.5
• CVE-2025-68140EVerest is an EV charging software stack. Prior to version 2…4.3
• CVE-2025-68142PyMdown Extensions is a set of extensions for the `Python-Ma…5.3
• CVE-2025-68143Model Context Protocol Servers is a collection of reference …8.8
• CVE-2025-68144In mcp-server-git versions prior to 2025.12.17, the git_diff…7.1
• CVE-2025-68145In mcp-server-git versions prior to 2025.12.17, when the ser…9.1
• CVE-2025-68146filelock is a platform-independent file lock for Python. In …6.5
• CVE-2025-68147Open Source Point of Sale (opensourcepos) is a web based poi…8.1