CVE-2021-22818 Auth bypass in n/a

High 7.5 Published 28 Jan 2022 Updated 3 Aug 2024

Attackers can gain unauthorized access to EV charging station web interfaces via brute force attacks due to missing rate limiting.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-22818?

CVE-2021-22818 is a high-severity authentication bypass vulnerability in n/a, published on 28 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the charging station web interface by performing brute force attacks. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)

Weakness: CWE-307

Which versions are affected by CVE-2021-22818?

It affects 6 products.

Products include Schneider-Electric Evlink City Evc1s22p4 Firmware, Schneider-Electric Evlink City Evc1s7p4 Firmware, Schneider-Electric Evlink Parking Evf2 Firmware, Schneider-Electric Evlink Parking Evp2pe Firmware, Schneider-Electric Evlink Parking Evw2 Firmware, Schneider-Electric Evlink Smart Wallbox Evb1a Firmware.

How do I fix CVE-2021-22818?

No fix has been published for CVE-2021-22818 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-22818 being exploited?

There is no known exploitation of CVE-2021-22818 in the wild and no public exploit code.

Sources

Also known as GHSA-g234-r5wx-qx69.