CVE-2021-22821 Server-side request forgery in n/a

High 8.6 Published 28 Jan 2022 Updated 3 Aug 2024

An attacker can force the charging station web server to forward requests to unintended network targets via crafted parameters.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-22821?

CVE-2021-22821 is a high-severity server-side request forgery vulnerability in n/a, published on 28 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious parameters are submitted to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)

Weakness: CWE-918

Which versions are affected by CVE-2021-22821?

It affects 6 products.

Products include Schneider-Electric Evlink City Evc1s22p4 Firmware, Schneider-Electric Evlink City Evc1s7p4 Firmware, Schneider-Electric Evlink Parking Evf2 Firmware, Schneider-Electric Evlink Parking Evp2pe Firmware, Schneider-Electric Evlink Parking Evw2 Firmware, Schneider-Electric Evlink Smart Wallbox Evb1a Firmware.

How do I fix CVE-2021-22821?

No fix has been published for CVE-2021-22821 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2021-22821 being exploited?

There is no known exploitation of CVE-2021-22821 in the wild and no public exploit code.

Sources

Also known as GHSA-xp5x-9h6p-q3rf.