Stored Cross-site Scripting Vulnerability in Schneider Electric EVlink Products
CVE-2021-22722
Key Information:
What is CVE-2021-22722?
A Stored Cross-site Scripting vulnerability exists in various Schneider Electric EVlink products, which can lead to code injection. This issue arises when users import a CSV file or modify station parameters, potentially allowing malicious scripts to be executed in the context of a web browser. Users are advised to update to R8 V3.4.0.1 or later to mitigate these risks.
Affected Version(s)
EVlink City (EVC1S22P4 / EVC1S7P4 all prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all prior to R8 V3.4.0.1 ) EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )