CVE-2021-22726

HIGH

8.1

Beschreibung

A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to perform unintended actions or access to data when crafted malicious parameters are submitted to the charging station web server.

CVE Details

CVSS v3.1 Bewertung8.1

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht7/21/2021

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

schneider-electric:evlink_city_evc1s22p4schneider-electric:evlink_city_evc1s22p4_firmwareschneider-electric:evlink_city_evc1s7p4schneider-electric:evlink_city_evc1s7p4_firmwareschneider-electric:evlink_parking_ev.2schneider-electric:evlink_parking_ev.2_firmwareschneider-electric:evlink_parking_evf2schneider-electric:evlink_parking_evf2_firmwareschneider-electric:evlink_parking_evw2schneider-electric:evlink_parking_evw2_firmwareschneider-electric:evlink_smart_wallbox_evb1aschneider-electric:evlink_smart_wallbox_evb1a_firmware

Schwachen (CWE)

CWE-918

Referenzen

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06(cybersecurity@se.com)

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.