A critical resource exhaustion vulnerability in the EVerest EV charging software stack allows unauthenticated attackers to crash the service, potentially disrupting electric vehicle charging sessions.

The vulnerability is a resource management flaw (CWE-770) where the software fails to properly destroy existing sessions and sockets upon receiving new SDP requests. This leads to a null pointer dereference that can be triggered by an unauthenticated attacker over the network.

Successful exploitation of this vulnerability results in a denial of service for the affected EV charging infrastructure. Given the CVSS score of 7.4, this high-severity flaw could lead to significant operational disruption, requiring manual intervention to restore charging services and potentially causing reputational damage for service providers.

Immediate Action: Update the EVerest everest-core software to version 2025.10.0 or later to include the necessary resource handling fixes.

Proactive Monitoring: Monitor system logs for unexpected service restarts or frequent error messages related to socket management and TCP connection failures.

Compensating Controls: Implement network-level access controls to restrict access to the charging stack management interface, limiting the exposure to untrusted network traffic.

Public Exploit Available: No (unknown)

The severity of this vulnerability is elevated by its potential to cause service outages in critical charging infrastructure. Organizations utilizing EVerest software should prioritize patching to version 2025.10.0 immediately to prevent potential denial of service attacks. If an immediate update is not feasible, restrict network access to the affected charging controllers to mitigate the risk of exploitation.