PT-2021-3727 · Schneider Electric · Evlink Parking+2

Published 2021-07-13 · Updated 2021-07-28 · CVE-2021-22708

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EVlink City versions prior to R8 V3.4.0.1 EVlink Parking versions prior to R8 V3.4.0.1 EVlink Smart Wallbox versions prior to R8 V3.4.0.1

Description A vulnerability exists due to improper verification of cryptographic signatures, which could allow an attacker to craft a malicious firmware package and bypass the signature verification mechanism. This issue is related to errors in checking cryptographic signatures, potentially enabling a remote attacker to create a harmful package and evade the signature verification process.

Recommendations For EVlink City versions prior to R8 V3.4.0.1, update to version R8 V3.4.0.1 or later to resolve the issue. For EVlink Parking versions prior to R8 V3.4.0.1, update to version R8 V3.4.0.1 or later to resolve the issue. For EVlink Smart Wallbox versions prior to R8 V3.4.0.1, update to version R8 V3.4.0.1 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2021-03967

CVE-2021-22708

Affected Products

Evlink City

Evlink Parking

Evlink Smart Wallbox

References · 6

• https://bdu.fstec.ru/vul/2021-03967 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22708 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22708 · Vendor Advisory
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06 · Vendor Advisory
• https://download.schneider-electric.com/files?pDocRefSEVD-2021-194-06 · Note
• https://t.me/cibsecurity/26339 · Telegram Post