CVE-2021-22722 : Vulnerability Insights and Analysis

A CWE-79 vulnerability has been identified in EVlink City, EVlink Parking, and EVlink Smart Wallbox products, allowing code injection via CSV file import or station parameter change.

Understanding CVE-2021-22722

This CVE involves a Stored Cross-site Scripting vulnerability affecting multiple versions of Schneider Electric's EV charging products.

What is CVE-2021-22722?

CVE-2021-22722 is a CWE-79 vulnerability that enables code injection through improper input handling during web page generation in EVlink City, EVlink Parking, and EVlink Smart Wallbox products.

The Impact of CVE-2021-22722

The vulnerability could be exploited to inject malicious code into the affected systems, potentially leading to unauthorized access and data theft.

Technical Details of CVE-2021-22722

The following technical details outline the specifics of the CVE:

Vulnerability Description

The vulnerability arises from improper neutralization of input, specifically during web page generation, allowing for Stored Cross-site Scripting attacks.

Affected Systems and Versions

EVlink City (all versions prior to R8 V3.4.0.1), EVlink Parking (all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (all versions prior to R8 V3.4.0.1) are affected by this vulnerability.

Exploitation Mechanism

The vulnerability can be exploited through actions such as importing a CSV file or altering station parameters, enabling attackers to inject and execute malicious scripts.

Mitigation and Prevention

To address CVE-2021-22722, immediate action and long-term security practices are essential:

Immediate Steps to Take

Implement the security updates provided by Schneider Electric promptly.
Restrict access to the vulnerable systems and monitor for any suspicious activities.

Long-Term Security Practices

Regularly update the software and firmware of EVlink products to mitigate potential security risks.
Conduct security assessments and penetration testing to identify and address vulnerabilities proactively.

Patching and Updates

Schneider Electric has released R8 V3.4.0.1 to address the CVE-2021-22722 vulnerability, and users are advised to apply this patch immediately to secure their EV charging infrastructure.