CVE-2021-22707 : Vulnerability Insights and Analysis

A CWE-798 vulnerability has been identified in Schneider Electric's EVlink City, EVlink Parking, and EVlink Smart Wallbox products, allowing unauthorized commands with administrative privileges.

Understanding CVE-2021-22707

This CVE-2021-22707 affects multiple products under the EVlink series by Schneider Electric due to a CWE-798 vulnerability.

What is CVE-2021-22707?

CVE-2021-22707 is a Use of Hard-coded Credentials vulnerability present in EVlink City, EVlink Parking, and EVlink Smart Wallbox products, enabling attackers to issue unauthorized commands to the charging station web server.

The Impact of CVE-2021-22707

The vulnerability could be exploited by threat actors to execute unauthorized commands with administrative rights on the affected charging stations, potentially leading to a complete compromise of the device's security.

Technical Details of CVE-2021-22707

The following technical details outline the vulnerability, affected systems, and the exploitation mechanism.

Vulnerability Description

The vulnerability allows attackers to exploit hard-coded credentials in EVlink City, EVlink Parking, and EVlink Smart Wallbox products, enabling unauthorized commands with administrator privileges.

Affected Systems and Versions

All versions of EVlink City (EVC1S22P4 / EVC1S7P4), EVlink Parking (EVW2 / EVF2 / EV.2), and EVlink Smart Wallbox (EVB1A) prior to R8 V3.4.0.1 are affected by CVE-2021-22707.

Exploitation Mechanism

Attackers can take advantage of the hard-coded credentials to interact with the affected charging station's web server, granting them unauthorized administrative control.

Mitigation and Prevention

To secure your systems against CVE-2021-22707, immediate steps, as well as long-term security practices and patching procedures, are crucial.

Immediate Steps to Take

It is recommended to update the affected products to version R8 V3.4.0.1 or later to mitigate the vulnerability. Additionally, changing default passwords and implementing network security measures are advised.

Long-Term Security Practices

Regularly monitoring for security updates, conducting security audits, and educating users about safe practices can enhance the overall security posture against such vulnerabilities.

Patching and Updates

Schneider Electric has released patches addressing the CVE-2021-22707 vulnerability. Ensure prompt application of these patches to safeguard the charging infrastructure from potential exploits.