PT-2021-7770 · Schneider Electric · Evlink Parking+2

Published 2021-07-13 · Updated 2021-07-27 · CVE-2021-22722

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions EVlink City versions prior to R8 V3.4.0.1 EVlink Parking versions prior to R8 V3.4.0.1 EVlink Smart Wallbox versions prior to R8 V3.4.0.1

Description A CWE-79: Improper Neutralization of Input During Web Page Generation ('Stored Cross-site Scripting') issue exists that could cause code injection when importing a CSV file or changing station parameters. This allows a remote attacker to inject arbitrary code.

Recommendations For EVlink City versions prior to R8 V3.4.0.1, update to R8 V3.4.0.1 or later to resolve the issue. For EVlink Parking versions prior to R8 V3.4.0.1, update to R8 V3.4.0.1 or later to resolve the issue. For EVlink Smart Wallbox versions prior to R8 V3.4.0.1, update to R8 V3.4.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the import of CSV files and changing station parameters until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-02710

CVE-2021-22722

Affected Products

Evlink City

Evlink Parking

Evlink Smart Wallbox

References · 9

• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02710 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22722 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22722 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06 · Note
• https://cwe.mitre.org/data/definitions/759.html · Note
• https://t.me/cibsecurity/26350 · Telegram Post
• https://vuldb.com/?id.179377 · Note
• https://t.me/cvenotify/18207 · Telegram Post