{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-09T06:02:00.412","vulnerabilities":[{"cve":{"id":"CVE-2025-68139","sourceIdentifier":"security-advisories@github.com","published":"2026-01-21T20:16:06.167","lastModified":"2026-02-06T21:22:10.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminate_connection_on_failed_response` is `False`, which leaves the responsibility for session and connection termination to the EV. In this configuration, any errors encountered by the module are logged but do not trigger countermeasures such as session and connection reset or termination. This could be abused by a malicious user in order to exploit other weaknesses or vulnerabilities. While the default will stay at the setting that is described as potentially problematic in this reported issue, a mitigation is available by changing the `terminate_connection_on_failed_response`  setting to `true`. However this cannot be set to this value by default since it can trigger errors in vehicle ECUs requiring ECU resets and lengthy unavailability in charging for vehicles. The maintainers judge this to be a much more important workaround then short-term unavailability of an EVSE, therefore this setting will stay at the current value."},{"lang":"es","value":"EVerest es una pila de software de carga de vehículos eléctricos. En todas las versiones hasta la 2025.12.1 inclusive, el valor predeterminado para `terminate_connection_on_failed_response` es `False`, lo que deja la responsabilidad de la terminación de la sesión y la conexión al vehículo eléctrico. En esta configuración, cualquier error encontrado por el módulo se registra pero no activa contramedidas como el restablecimiento o la terminación de la sesión y la conexión. Esto podría ser abusado por un usuario malintencionado para explotar otras debilidades o vulnerabilidades. Aunque el valor predeterminado se mantendrá en la configuración que se describe como potencialmente problemática en este problema reportado, una mitigación está disponible cambiando la configuración de `terminate_connection_on_failed_response` a `true`. Sin embargo, esto no puede establecerse a este valor por defecto ya que puede desencadenar errores en las ECUs de los vehículos, requiriendo restablecimientos de la ECU y una prolongada indisponibilidad en la carga para los vehículos. Los mantenedores juzgan que esta es una solución alternativa mucho más importante que la indisponibilidad a corto plazo de un EVSE, por lo tanto, esta configuración se mantendrá en el valor actual."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-384"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linuxfoundation:everest:*:*:*:*:*:*:*:*","versionEndIncluding":"2025.12.1","matchCriteriaId":"C2054B5F-AED8-4768-8D31-2B05D3CF67EC"}]}]}],"references":[{"url":"https://github.com/EVerest/everest-core/security/advisories/GHSA-wqh4-pj54-6xv9","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}