CVE-2021-22707 — Vulnetix

CVE-2021-22707 PUBLISHED CVSS 9.800000190734863 CRITICAL

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to issue unauthorized commands to the charging station web server with administrative privileges.

EPSS 91.56% · 99.7th percentile

Risk Scores

CVSS v3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

91.56%

99.7th percentile

Affected Products

Vendor	Product	Versions
schneider-electric	evlink_smart_wallbox_evb1a_firmware	0
schneider-electric	evlink_parking_evw2_firmware	0
schneider-electric	evlink_city_evc1s22p4_firmware	0
n/a	EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )	*
schneider-electric	evlink_parking_ev.2_firmware	0
schneider-electric	evlink_parking_evf2_firmware	0
schneider-electric	evlink_city_evc1s7p4_firmware	0

Timeline

Jul 16, 2021 PoC Published
Jul 21, 2021 CVE Published
Jul 22, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Mar 7, 2023 EPSS Score
Aug 10, 2023 EPSS Score
Aug 17, 2023 EPSS Score
Nov 10, 2023 EPSS Score
Feb 25, 2024 EPSS Score
Apr 5, 2024 EPSS Score

References

Open in Interactive Console →