PT-2021-7771 · Schneider Electric · Evlink Parking+2

Published 2021-07-13 · Updated 2021-07-28 · CVE-2021-22726

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions EVlink City versions prior to R8 V3.4.0.1 EVlink Parking versions prior to R8 V3.4.0.1 EVlink Smart Wallbox versions prior to R8 V3.4.0.1

Description A Server-Side Request Forgery (SSRF) issue exists that could allow an attacker to perform unintended actions or access data when crafted malicious parameters are submitted to the charging station web server. This could enable a remote attacker to execute unauthorized actions or gain access to protected information.

Recommendations For EVlink City versions prior to R8 V3.4.0.1, update to R8 V3.4.0.1 or later to resolve the issue. For EVlink Parking versions prior to R8 V3.4.0.1, update to R8 V3.4.0.1 or later to resolve the issue. For EVlink Smart Wallbox versions prior to R8 V3.4.0.1, update to R8 V3.4.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the charging station web server to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2023-02711

CVE-2021-22726

Affected Products

Evlink City

Evlink Parking

Evlink Smart Wallbox

References · 8

• https://bdu.fstec.ru/vul/2023-02711 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22726 · Security Note
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22726 · Vendor Advisory
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06 · Note
• https://cwe.mitre.org/data/definitions/759.html · Note
• https://t.me/cibsecurity/26343 · Telegram Post
• https://vuldb.com/?id.179377 · Note