Vulnerability

CERT-In Vulnerability Note CIVN-2021-0389
Multiple Vulnerabilities in Schneider Electric Vehicle Charging Stations

Original Issue Date:December 31, 2021

Severity Rating: HIGH

Software Affected

EVlink City EVC1S22P4 / EVC1S7P4All versions prior to R8 V3.4.0.1
EVlink Parking EVW2 / EVF2 / EV.2 All versions prior to R8 V3.4.0.1
EVlink Smart WallboxEVB1A All versions prior to R8 V3.4.0.1

Overview

Multiple Vulnerabilities have been reported in Schneider Electric Vehicle Charging Stations which could allow a remote attacker to execute brute-force attacks and cause denial of service condition on the targeted system.

Description

1. Cross-site Scripting (XSS) Vulnerability ( CVE-2021-22722   CVE-2021-22723   CVE-2021-22706   )

This Vulnerability exits in Schneider Electric Vehicle Charging Stations due to improper input validation. A remote attacker could exploit this vulnerability by injecting malicious script into a Web page.
Successful exploitation of this vulnerability could allow a remote attacker to perform brute force attack and compromise the targeted system.

2. Security Bypass Vulnerability ( CVE-2021-22708   CVE-2021-22727   CVE-2021-22773   )

This Vulnerability exits in Schneider Electric Vehicle Charging Stations due to improper verification of cryptographic signature, insufficient entropy vulnerability and unverified password change vulnerability in charging station�s web server. A remote attacker could exploit this vulnerability by sending specially-crafted request.
Successful exploitation of this vulnerability could allow a remote attacker to bypass security restrictions on the targeted system.

3. Information disclosure vulnerability ( CVE-2021-22721   CVE-2021-22728   CVE-2021-22774   )

This Vulnerability exits in Schneider Electric Vehicle Charging Stations due to use of a one-way hash without a salt vulnerability, flaw in the charging station�s web server and in the maintenance report. A remote attacker could exploit this vulnerability by sending specially-crafted request.
Successful exploitation of this vulnerability could allow a remote attacker to obtain sensitive information on the targeted system.

4. Server-side request forgery (SSRF) vulnerability ( CVE-2021-22726   )

This Vulnerability exits in Schneider Electric Vehicle Charging Stations due to malicious manipulation of charging stations web servers. A remote attacker could exploit this vulnerability by sending specially-crafted request.
Successful exploitation of this vulnerability could allow a remote attacker to disclose sensitive information and cause denial of service condition on the targeted system.

5. Use of Hard-coded Credentials ( CVE-2021-22707   CVE-2021-22729   CVE-2021-22730   )

This Vulnerability exits in Schneider Electric Vehicle Charging Stations due to the use of default hard-coded credentials. A remote attacker could exploit this vulnerability by accessing the default credentials.
Successful exploitation of this vulnerability could allow a remote attacker to gain administrative privileges on the targeted system.

Solution

Apply appropriate updates as mentioned:
https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2021-194-06_EVlink_City_Parking_SmartWallbox_Charging_Stations_Security_Notification.pdf&p_Doc_Ref=SEVD-2021-194-06

https://www.se.com/fr/fr/product-range/63015-evlink-city/#documents

https://www.se.com/ww/en/product-range/60850-evlink-parking/#software-and-firmware

https://www.se.com/ww/en/product-range/63506-evlink-smart-wallbox/#software-and-firmware

Vendor Information

Schneider Electric
https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2021-194-06_EVlink_City_Parking_SmartWallbox_Charging_Stations_Security_Notification.pdf&p_Doc_Ref=SEVD-2021-194-06

References

https://www.securityweek.com/new-flaws-expose-evlink-electric-vehicle-charging-stations-remote-hacking
https://thecyberthrone.in/2021/12/28/schneider-evlink-charging-unit-remotely-hackable/?utm_source=rss&utm_medium=rss&utm_campaign=schneider-evlink-charging-unit-remotely-hackable

CVE Name
CVE-2021-22706
CVE-2021-22707
CVE-2021-22708
CVE-2021-22721
CVE-2021-22722
CVE-2021-22723
CVE-2021-22726
CVE-2021-22727
CVE-2021-22728
CVE-2021-22729
CVE-2021-22730
CVE-2021-22773
CVE-2021-22774

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India