CVE-2021-22721 Information disclosure in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )
An attacker can obtain limited JavaScript code knowledge from EVlink charging stations by submitting crafted malicious parameters to the web server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22721?
CVE-2021-22721 is a medium-severity vulnerability in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ), published on 21 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to get limited knowledge of javascript code when crafted malicious parameters are submitted to the charging station web server.
Weakness: CWE-200
Which versions are affected by CVE-2021-22721?
It affects 6 products.
Products include Schneider-Electric Evlink City Evc1s22p4 Firmware, Schneider-Electric Evlink City Evc1s7p4 Firmware, Schneider-Electric Evlink Parking Ev.2 Firmware, Schneider-Electric Evlink Parking Evf2 Firmware, Schneider-Electric Evlink Parking Evw2 Firmware, Schneider-Electric Evlink Smart Wallbox Evb1a Firmware.
How do I fix CVE-2021-22721?
No fix has been published for CVE-2021-22721 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22721 being exploited?
There is no known exploitation of CVE-2021-22721 in the wild and no public exploit code.
Other vulnerabilities in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )
- CVE-2021-22820 Auth bypass in n/a
- CVE-2021-22707 Hardcoded credentials in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )
- CVE-2021-22727 Weak cryptography in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )
- CVE-2021-22729 Hardcoded credentials in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )
- CVE-2021-22730 Hardcoded credentials in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )
Sources
Also known as GHSA-68w7-v8mp-33m7.