CVE-2025-68139 is a session fixation vulnerability classified under CWE-384 found in the EVerest everest-core software, a critical component of the EV charging ecosystem. The vulnerability arises because the default configuration for the parameter terminate_connection_on_failed_response is set to false, meaning that when the module encounters errors, it logs them but does not reset or terminate the session or connection. This behavior leaves session management responsibilities to the electric vehicle (EV) itself, potentially allowing an attacker to exploit session fixation or other related session management weaknesses. Session fixation attacks can enable an attacker to hijack or manipulate sessions by forcing a user to use a known session identifier. The maintainers have chosen not to enable the safer setting by default because doing so can cause vehicle electronic control units (ECUs) to reset, resulting in temporary unavailability of charging services and operational disruptions. This trade-off prioritizes vehicle stability over immediate security hardening. The vulnerability affects all versions up to and including 2025.12.1. The CVSS v3.1 score is 4.3 (medium severity), reflecting that the attack vector is adjacent network (AV:A), requires no privileges or user interaction, and impacts integrity but not confidentiality or availability. No public exploits have been reported yet, but the vulnerability could be leveraged as part of a broader attack chain targeting EV charging infrastructure or vehicle systems. The lack of a default secure configuration means that operators must proactively adjust settings to mitigate risk, balancing security with operational constraints.

For European organizations, particularly those operating EV charging infrastructure or managing fleets of electric vehicles, this vulnerability poses a moderate risk. Exploitation could allow attackers to manipulate session states, potentially enabling unauthorized actions or facilitating further attacks on the EV or charging station systems. While the vulnerability does not directly compromise confidentiality or availability, it undermines session integrity, which could lead to unauthorized charging sessions, billing fraud, or disruption of charging workflows. The operational impact is complicated by the fact that enabling the mitigation setting may cause vehicle ECU resets, leading to temporary unavailability of charging services and customer dissatisfaction. This trade-off could affect service reliability and trust in EV charging networks. Given Europe's strong push towards EV adoption and the critical role of charging infrastructure, any disruption or security compromise could have cascading effects on transportation and energy sectors. Additionally, attackers might leverage this vulnerability as a foothold for more sophisticated attacks targeting connected vehicle systems or grid management components.

European EV charging operators and software integrators using EVerest everest-core should immediately evaluate the feasibility of enabling the terminate_connection_on_failed_response setting to true, understanding that this may cause ECU resets and temporary vehicle charging unavailability. To mitigate operational impact, operators should implement this change during planned maintenance windows and communicate potential disruptions to customers. Additionally, monitoring and anomaly detection should be enhanced around session management events to detect suspicious session fixation attempts or abnormal session behaviors. Operators should also ensure that their EVSE (Electric Vehicle Supply Equipment) firmware and software are updated to the latest versions beyond 2025.12.1 once patches or safer default configurations become available. Network segmentation and strict access controls should be enforced to limit exposure of the EV charging management interfaces to trusted networks only. Finally, collaboration with vehicle manufacturers to better understand ECU reset impacts and explore firmware updates that tolerate stricter session management policies without causing resets could provide a longer-term resolution.