PT-2021-7774 · Schneider Electric · Evlink Parking+2

Published 2021-07-13 · Updated 2021-07-28 · CVE-2021-22730

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EVlink City versions prior to R8 V3.4.0.1 EVlink Parking versions prior to R8 V3.4.0.1 EVlink Smart Wallbox versions prior to R8 V3.4.0.1

Description A Use of Hard-coded Credentials issue exists, allowing a remote attacker to gain unauthorized administrative privileges when accessing the charging station web server.

Recommendations For EVlink City versions prior to R8 V3.4.0.1, update to R8 V3.4.0.1 or later. For EVlink Parking versions prior to R8 V3.4.0.1, update to R8 V3.4.0.1 or later. For EVlink Smart Wallbox versions prior to R8 V3.4.0.1, update to R8 V3.4.0.1 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2023-02714

CVE-2021-22730

Affected Products

Evlink City

Evlink Parking

Evlink Smart Wallbox

References · 9

• https://osv.dev/vulnerability/CVE-2021-22730 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02714 · Security Note
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22730 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06 · Note
• https://cwe.mitre.org/data/definitions/759.html · Note
• https://t.me/cvenotify/18256 · Telegram Post
• https://t.me/cibsecurity/26340 · Telegram Post
• https://vuldb.com/ar/?id.179346 · Note