High severity · published Jan 28, 2022
CVE-2021-22821
A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious…
8.6
CVSS
0.8%
EPSS
No
On KEV
Description
A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious parameters are submitted to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Evlink City Evc1s22p4 Firmware · Schneider-electric
before 3.4.0.2 · source: NVD
EC
Evlink City Evc1s7p4 Firmware · Schneider-electric
before 3.4.0.2 · source: NVD
EP
Evlink Parking Evf2 Firmware · Schneider-electric
before 3.4.0.2 · source: NVD
EP
Evlink Parking Evp2pe Firmware · Schneider-electric
before 3.4.0.2 · source: NVD
EP
Evlink Parking Evw2 Firmware · Schneider-electric
before 3.4.0.2 · source: NVD
ES
Evlink Smart Wallbox Evb1a Firmware · Schneider-electric
before 3.4.0.2 · source: NVD
Affected product
EC
Evlink City Evc1s22p4 Firmware
Schneider-electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22821
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22821
Patch
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02
More from Evlink City Evc1s22p4 Firmware
9.8
CVE-2021-22820
A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web…
9.8
CVE-2021-22730
A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all…
9.8
CVE-2021-22729
A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions…
9.8
CVE-2021-22727
A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior…
9.8
CVE-2021-22707
A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all…