Insufficient Session Expiration in EVlink Charging Stations by Schneider Electric

CVE-2021-22820

Summary

This vulnerability allows an attacker to retain access to a compromised session on EVlink Charging Stations' web servers, even if the legitimate user has changed their password. If the session is not promptly terminated or expired, unauthorized users may exploit this flaw to gain continued access and control over the user's account. This poses significant risks to user security, as attackers could manipulate connected charging stations or alter configurations without the user’s consent.

References