A critical integer overflow vulnerability in the EVerest charging software stack, version 2025.10.0 and earlier, poses a significant risk of remote code execution or denial of service.

The vulnerability exists in the SdpPacket::parse_header() function where an integer overflow occurs during packet header parsing. This allows an unauthenticated attacker to manipulate memory pointers, leading to either an infinite loop or a stack-based buffer overflow depending on the transport protocol used.

The potential for remote code execution or service disruption in an EV charging infrastructure stack presents a severe operational risk. Given the CVSS score of 8.3, this flaw enables attackers to compromise the integrity and availability of charging stations, which could lead to widespread service outages and potential unauthorized control over critical infrastructure components.

Immediate Action: Upgrade EVerest everest-core to version 2025.10.0 or later to apply the fix for the integer overflow.

Proactive Monitoring: Monitor network traffic directed at EV charging controller interfaces for malformed packets or unexpected spikes in CPU usage that could indicate an infinite loop attack.

Compensating Controls: Implement network segmentation to isolate EV charging stacks from public-facing networks and utilize intrusion detection systems to identify anomalous SDP packet structures.

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available at this time.

This vulnerability represents a high-severity risk to charging infrastructure due to its potential to trigger memory corruption or denial of service. Administrators should prioritize updating the EVerest software stack to version 2025.10.0 immediately to eliminate the underlying integer overflow condition and ensure system stability.