CVE-2021-22707observed exploitationCWE-798

CVE-2021-22707: vulnerability in EVlink City (EVC1S22P4 / EVC1S7P4 all versions…

Published · Updated

Follow this CVE+ Monitor EVlink City, EVlink Parking, and EVlink Smart Wallbox

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

52Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 65%
from disclosure to weapon
Published on NVDJul 21
VulnCheck+938d
In short

These EV charging station devices contain hardcoded credentials in their software, allowing anyone who discovers them to gain admin access to the device's web interface and control the charging stations without permission.

Technical detail

CWE-798 hardcoded credentials vulnerability affecting EVlink City, Parking, and Smart Wallbox devices (all versions before R8 V3.4.0.1). An attacker with network access to the web server can authenticate using embedded administrative credentials to execute unauthorized administrative commands and potentially disrupt charging operations or extract sensitive data.

Summary generated and translated by AI from the official description.
A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to issue unauthorized commands to the charging station web server with administrative privileges.
Affected products
n/a · EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )