EVerest everest-core versions 2025.9.0 and below are vulnerable to a remote denial of service attack that can terminate the charging software stack.

This is a resource allocation issue (CWE-770) where the application spawns new threads for incoming TCP or TLS connections without adequate rate limiting or prior verification. An unauthenticated attacker can exploit this by opening an unlimited number of connections, leading to memory exhaustion and system-wide termination of EVSE functionality.

The exploitation of this vulnerability results in a complete denial of service for the affected EV charging infrastructure. Given the CVSS score of 7.4, this poses a significant risk to operational continuity, potentially rendering charging stations unavailable to the public or private users. Such downtime can lead to service disruptions and require manual intervention to restore system operations.

Immediate Action: Update the EVerest everest-core software to version 2025.10.0 or later to implement proper resource throttling and connection verification.

Proactive Monitoring: Monitor system logs for a surge in incoming TCP connection requests or unexpected thread exhaustion errors that may indicate an attempt to trigger this condition.

Compensating Controls: Deploy network-level traffic shaping or firewall rules to limit the number of concurrent connections from single source IP addresses to the charging station controller.

Public Exploit Available: No (exploit_available: unknown)

Due to the critical nature of charging infrastructure and the ease of triggering this denial of service, organizations must prioritize the application of the 2025.10.0 update. Administrators should verify the patch deployment across all managed EVSE units to ensure stability and prevent potential service outages caused by resource exhaustion attacks.