IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2025-161-03 — EVLink WallBox

HIGH
CVSS 7.2
Date 2026-10-16T20:31:43+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 10-Jun-25 (08 July 2025) Document Reference Number – SEVD-2025-161-03 (v1.1.0) Page 1 of 4 Public / TLP: Clear > Public ## EVLink WallBox 10 June 2025 (8 July 2025) ## Overview Schneider Electric is aware of multiple vulnerabilities in its EVLink WallBox product. The EVLink WallBox is a charging station for electric vehicles at home or on private property, suitable for indoor and outdoor use. Failure to apply the mitigations provided below may risk arbitrary file read, cross-site scripting and remote code execution from a user with authenticated access to the web server, which could result in information disclosure, service interruption, and gain full control of the charging station. July 2025 Update: Updated vulnerability details for CVE-2025-5740 as the vulnerability requires the attacker to be authenticated. ## Affected Products and Versions Product Version EVLink WallBox All versions ## Vulnerability Details CVE ID: CVE-2025-5740 CVSS v3.1 Base Score 7.2 | High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score 8.6 | High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' ) vulnerability exists that could cause arbitrary file writes when an authenticated user on the web server manipulates file path. CVE ID: CVE-2025-5741 CVSS v3.1 Base Score 4.9 | Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS v4.0 Base Score 6.9 | Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file reads from the charging station. The exploitation of this vulnerability does require an authenticated session of the web server. Schneider Electric Security Notification

// Vulnerabilities (4)

CVE ID CVSS Score Severity Description
CVE-2025-5741 7.2 high
CVE-2025-5741. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file reads from the charging station. The exploitation of this vulnerability does require an authenticated session of the web server.
CVE-2025-5742 7.2 high
CVE-2025-5742. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists when an authenticated user modifies configuration parameters on the web server
CVE-2025-5743 7.2 high
CVE-2025-5743. CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote control over the charging station when an authenticated user modifies configuration parameters on the web server.
CVE-2025-5740 7.2 high
CVE-2025-5740. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file writes when an authenticated user on the web server manipulates file path.

// Remediations (1)

Mitigation: Customers should immediately apply the following mitigations to reduce the risk of exploit: * Fir
Customers should immediately apply the following mitigations to reduce the risk of exploit: * Firewall configuration & logs: o Setup network segmentation and implement a firewall to block all unauthorized access to HTTP ports o Check the access log periodically * Password: o Choose a strong password o Do not share your password o Change your password periodically Customers should also consider upgrading to the replacement product offering EVLink Pro AC https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#products to resolve these issues.

// References