PT-2024-38784 · Schneider Electric · Evlink Home Smart/Charge Firmware

Published 2024-10-13 · Updated 2025-02-04 · CVE-2024-8070

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Schneider Electric EVlink Home Smart/Charge Firmware (affected versions not specified)

Description: A Cleartext Storage of Sensitive Information issue exists, exposing test credentials in the firmware binary. This could lead to data exposure. The vulnerability is being actively exploited.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2024-8070

Affected Products

Evlink Home Smart/Charge Firmware

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-8070 · Security Note
• https://t.me/cvedetector/7791 · Telegram Post
• https://twitter.com/transilienceai/status/1886880125402157182 · Twitter Post
• https://twitter.com/oktsec/status/1845579705568616557 · Twitter Post
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-282-04.pdf · Note
• https://t.me/latest_high_impact_cve/1317 · Telegram Post
• https://twitter.com/CveFindCom/status/1845563183211196679 · Twitter Post
• https://t.me/cvenotify/97955 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1845597077805342738 · Twitter Post
• https://twitter.com/CVEnew/status/1845559347729871277 · Twitter Post
• https://twitter.com/cracbot/status/1846793347647918208 · Twitter Post