Use of Hard-coded Credentials in Schneider Electric EVlink Products
CVE-2021-22707

9.8CRITICAL

Key Information:

Vendor

Schneider Electric
Status
Evlink City (evc1s22p4 / Evc1s7p4 All Versions Prior To R8 V3.4.0.1), Evlink Parking (evw2 / Evf2 / Ev.2 All Versions Prior To R8 V3.4.0.1), And Evlink Smart Wallbox (evb1a All Versions Prior To R8 V3.4.0.1 )
Vendor
CVE Published:
21 July 2021

What is CVE-2021-22707?

A vulnerability exists in multiple Schneider Electric EVlink products due to the presence of hard-coded credentials. This can enable an attacker to gain unauthorized administrative access to the charging station's web server, potentially allowing for the issuance of unauthorized commands. Affected products include various models of EVlink City, EVlink Parking, and EVlink Smart Wallbox, all prior to specific software versions.

Affected Version(s)

EVlink City (EVC1S22P4 / EVC1S7P4 all prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all prior to R8 V3.4.0.1 ) EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )

References

http://download.schneider-electric.com/files?p_Doc_Ref=SE...
x_refsource_MISC

EPSS Score

90% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.