Medium severity · published Jul 21, 2021
CVE-2021-22723
A CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-siteScripting) through Cross-Site Request Forgery (CSRF) vulnerability exists in EVlink City…
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
A CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-siteScripting) through Cross-Site Request Forgery (CSRF) vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to impersonate the user who manages the charging station or carry out actions on their behalf when crafted malicious parameters are submitted to the charging station web server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Evlink City Evc1s22p4 Firmware · Schneider-electric
before r8_v3.4.0.1 · source: NVD
EC
Evlink City Evc1s7p4 Firmware · Schneider-electric
before r8_v3.4.0.1 · source: NVD
EP
Evlink Parking Ev.2 Firmware · Schneider-electric
before r8_v3.4.0.1 · source: NVD
EP
Evlink Parking Evf2 Firmware · Schneider-electric
before r8_v3.4.0.1 · source: NVD
EP
Evlink Parking Evw2 Firmware · Schneider-electric
before r8_v3.4.0.1 · source: NVD
ES
Evlink Smart Wallbox Evb1a Firmware · Schneider-electric
before r8_v3.4.0.1 · source: NVD
Affected product
EC
Evlink City Evc1s22p4 Firmware
Schneider-electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22723
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22723
Vendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
More from Evlink City Evc1s22p4 Firmware
9.8
CVE-2021-22820
A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web…
9.8
CVE-2021-22730
A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all…
9.8
CVE-2021-22729
A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions…
9.8
CVE-2021-22727
A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior…
9.8
CVE-2021-22707
A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all…