Improper Neutralization of Input in Schneider Electric Charging Stations
CVE-2021-22822

6.1MEDIUM

Key Information:

Vendor
Schneider Electric
Status
Evlink City Evc1s22p4 Firmware
Vendor
CVE Published:
28 January 2022

Summary

A vulnerability exists in Schneider Electric's EVlink charging stations that allows for improper neutralization of input during web page generation. This can enable attackers to craft malicious parameters and impersonate the managing user or execute actions on their behalf, potentially compromising the security and operation of the charging stations. All versions prior to R8 V3.4.0.2 of various EVlink models are affected, highlighting the importance for users to update their systems immediately.

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.