A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the legitimate user account holder has changed his password. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)
Una CWE-614: Se presenta una vulnerabilidad de Caducidad de Sesión Insuficiente que podría permitir a un atacante mantener un acceso no autorizado a través de una sesión secuestrada al servidor web de la estación de carga incluso después de que el titular legítimo de la cuenta de usuario haya cambiado su contraseña. Productos afectados: EVlink City EVC1S22P4 / EVC1S7P4 (Todas las versiones anteriores a R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (Todas las versiones anteriores a R8 V3.4.0.2), y EVlink Smart Wallbox EVB1A (Todas las versiones anteriores a R8 V3.4.0.2)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-613
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | evlink_city_evc1s22p4_firmware | * | <built-in method update of dict object at 0x7e61068451c0> | Operating System |
| schneider-electric | evlink_city_evc1s7p4_firmware | * | <built-in method update of dict object at 0x7e60eb26f0c0> | Operating System |
| schneider-electric | evlink_parking_evw2_firmware | * | <built-in method update of dict object at 0x7e60eb26f080> | Operating System |
| schneider-electric | evlink_parking_evf2_firmware | * | <built-in method update of dict object at 0x7e61068448c0> | Operating System |
| schneider-electric | evlink_parking_evp2pe_firmware | * | <built-in method update of dict object at 0x7e6106844d80> | Operating System |
| schneider-electric | evlink_smart_wallbox_evb1a_firmware | * | <built-in method update of dict object at 0x7e6106844e80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:evlink_city_evc1s22p4_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:evlink_city_evc1s22p4:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:evlink_city_evc1s7p4_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:evlink_city_evc1s7p4:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:evlink_parking_evw2_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:evlink_parking_evw2:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:evlink_parking_evf2_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:evlink_parking_evf2:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:evlink_parking_evp2pe_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:evlink_parking_evp2pe:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:evlink_smart_wallbox_evb1a_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:evlink_smart_wallbox_evb1a:-:*:*:*:*:*:*:* |