CVE-2018-7800
📋 TL;DR
CVE-2018-7800 is a hard-coded credentials vulnerability in Schneider Electric EVLink Parking charging stations that allows attackers to gain unauthorized access to the device. This affects EVLink Parking version 3.2.0-12_v1 and earlier. Attackers can exploit this to potentially control charging stations or access sensitive systems.
💻 Affected Systems
- Schneider Electric EVLink Parking
📦 What is this software?
Evlink Parking Firmware by Schneider Electric
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of EVLink Parking devices allowing attackers to disable charging infrastructure, manipulate billing data, or use devices as footholds into corporate networks.
Likely Case
Unauthorized access to charging station management interfaces leading to service disruption, configuration changes, or data theft.
If Mitigated
Limited impact if devices are isolated on separate networks with strict firewall rules and access controls.
🎯 Exploit Status
Exploitation requires only knowledge of the hard-coded credentials, which are publicly documented in advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.2.0-12_v2 and later
Vendor Advisory: https://www.schneider-electric.com/en/download/document/SEVD-2018-354-01/
Restart Required: Yes
Instructions:
1. Download firmware version 3.2.0-12_v2 or later from Schneider Electric. 2. Follow vendor instructions to update firmware on all affected EVLink Parking devices. 3. Verify successful update and functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate EVLink Parking devices on separate VLANs with strict firewall rules limiting access to management interfaces.
Access Control Lists
allImplement IP-based access controls to restrict management interface access to authorized administrative IPs only.
🧯 If You Can't Patch
- Segment EVLink Parking devices on isolated networks with no internet access
- Implement strict firewall rules blocking all unnecessary ports and protocols
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or serial console. If version is 3.2.0-12_v1 or earlier, device is vulnerable.Check Version:
Check via web interface at http://[device-ip]/ or via serial console connectionVerify Fix Applied:
Verify firmware version is 3.2.0-12_v2 or later. Test authentication with previously known hard-coded credentials should fail.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful login with default credentials
- Multiple login attempts from unusual IP addresses
- Configuration changes from unauthorized users
Network Indicators:
- Unusual traffic patterns to/from EVLink Parking management ports (typically HTTP/HTTPS)
- Authentication attempts using known hard-coded credentials
SIEM Query:
source="EVLink" AND (event_type="authentication" AND result="success" AND user="default_admin")🔗 References
- http://www.securityfocus.com/bid/106807
- https://ics-cert.us-cert.gov/advisories/ICSA-19-031-01
- https://www.schneider-electric.com/en/download/document/SEVD-2018-354-01/
- http://www.securityfocus.com/bid/106807
- https://ics-cert.us-cert.gov/advisories/ICSA-19-031-01
- https://www.schneider-electric.com/en/download/document/SEVD-2018-354-01/
