Cross-Site Scripting Vulnerability in EVlink Charging Stations by Schneider Electric
CVE-2021-22706
Key Information:
What is CVE-2021-22706?
A Cross-Site Scripting vulnerability exists within various EVlink products manufactured by Schneider Electric. This flaw allows attackers to exploit improper input validation, enabling them to impersonate users who manage the charging stations. Through crafted malicious parameters sent to the charging station's web server, attackers could perform unauthorized actions on behalf of legitimate users, effectively compromising the security of the management interface and potentially leading to unintended consequences for both users and operators.
Affected Version(s)
EVlink City (EVC1S22P4 / EVC1S7P4 all prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all prior to R8 V3.4.0.1 ) EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )