Schneider Electric Patches 13 Vulnerabilities Affecting its EVlink Charging Stations

Schneider Electric, an energy management and automation company, has reportedly patched 13 critical vulnerabilities in its EVlink range of products. The EV product range is associated with electric vehicles and offers charging points/stations for private properties, semi-public car parks, and on-street charging. Talking about the criticality of the discovered vulnerabilities,  Schneider Electric said that the exploitation of these vulnerabilities “could lead to things like denial of service attacks, which could (further) result in unauthorized use of the charging station, service interruptions, failure to send charging data records to the supervision system and the modification and disclosure of the charging station’s configuration.”

Schneider Electric Vulnerabilities and Affected Products

In all, Schneider Electric addressed 13 flaws, which include three “critical”, eight “high” and two “medium” severity vulnerabilities. Schneider Electric further added that these vulnerabilities could be exploited by threat actors in only two ways:

1. Physical access to the charging station’s internal communication ports which can be gained only by removing the entire housing, or,
2. If the charging stations are directly connected to the internet or the network of the charging station’s supervision system (for remote exploitation)

The three most critical vulnerabilities and their respective CVE and CVSS scores are:

1. Use of Hard-coded Credentials

CVE ID: CVE-2021-22707

CVSS v3.1 Base Score 9.4 | Critical

CWE-798: This vulnerability could potentially allow an attacker to issue unauthorized commands to the charging station web server with administrative privileges.

2. Use of Hard-coded Password

CVE ID: CVE-2021-22729

CVSS v3.1 Base Score 9.4 | Critical

CWE-259: This vulnerability could potentially allow an attacker to gain unauthorized administrative privileges when accessing the charging station web server.

3. Use of Hard-coded Credentials

CVE ID: CVE-2021-22730

CVSS v3.1 Base Score 9.4 | Critical

CWE-798: This vulnerability could potentially allow an attacker to gain unauthorized administrative privileges when accessing the charging station web server.

The other “high” and “medium” vulnerabilities are:

• CVE-2021-22706 – Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’
• CVE-2021-22708 – Improper Verification of Cryptographic Signature
• CVE-2021-22721 – Improper Neutralization of Input During Web Page Generation (‘Stored Cross-site Scripting’)
• CVE-2021-22723 – Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) through Cross-Site Request Forgery (CSRF)
• CVE-2021-22726 – Server-Side Request Forgery (SSRF)
• CVE-2021-22727 – Insufficient Entropy
• CVE-2021-22728 – Information Exposure
• CVE-2021-22773 – Unverified Password Change
• CVE-2021-22774 – Use of a One-Way Hash without a Salt

Related News:

Schneider Electric and Claroty form cybersecurity partnership