CVE-2021-22724 HIGH

Published: 2022-01-28 | Last Modified: 2024-11-21 | Status: Modified

Description

A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitted in POST requests sent to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)

Additional Descriptions (1)

Se presenta una vulnerabilidad CVE-352 de tipo Cross-Site Request Forgery (CSRF) que podría permitir a un atacante hacerse pasar por el usuario o llevar a cabo acciones en su nombre cuando son enviados parámetros maliciosos diseñados en peticiones POST enviadas al servidor web de la estación de carga. Productos afectados: EVlink City EVC1S22P4 / EVC1S7P4 (Todas las versiones anteriores a R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (Todas las versiones anteriores a R8 V3.4.0.2), y EVlink Smart Wallbox EVB1A (Todas las versiones anteriores a R8 V3.4.0.2)

CVSS Metrics

Base Score: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	REQUIRED
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 5.9

Base Score: 6.8 (MEDIUM)

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector	NETWORK
Access Complexity	MEDIUM
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 6.4

Weaknesses

Source	Type	Description
[email protected]	Primary	en CWE-352

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	evc1s22p4_firmware	*	<built-in method update of dict object at 0x7e60bacd4b40>	Operating System
schneider-electric	evc1s7p4_firmware	*	<built-in method update of dict object at 0x7e60bacd7f80>	Operating System
schneider-electric	evw2_firmware	*	<built-in method update of dict object at 0x7e60bacd7e80>	Operating System
schneider-electric	evf2_firmware	*	<built-in method update of dict object at 0x7e60bacd6140>	Operating System
schneider-electric	evp2pe_firmware	*	<built-in method update of dict object at 0x7e60bacd6c40>	Operating System
schneider-electric	evb1a_firmware	*	<built-in method update of dict object at 0x7e60bacd64c0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:evc1s22p4_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:evc1s22p4:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:evc1s7p4_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:evc1s7p4:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:evw2_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:evw2:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:evf2_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:evf2:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:evp2pe_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:evp2pe:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:evb1a_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:evb1a:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02
Source: [email protected]

Patch Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02
Source: af854a3a-2127-422b-91ae-364da2661108

Patch Vendor Advisory