CVE-2021-22725 – This CSRF vulnerability in Schneider Electric E... (How to Fix)

Q: What is the severity of CVE-2021-22725?

CVE-2021-22725 has a CVSS score of 8.8 (HIGH). This CSRF vulnerability in Schneider Electric EVlink charging stations allows attackers to perform unauthorized actions by tricking authenticated users into submitting malicious POST requests. Affected products include EVlink City, EVlink Parking, and EVlink Smart Wallbox models running firmware versions prior to R8 V3.4.0.2.

📋 TL;DR

This CSRF vulnerability in Schneider Electric EVlink charging stations allows attackers to perform unauthorized actions by tricking authenticated users into submitting malicious POST requests. Affected products include EVlink City, EVlink Parking, and EVlink Smart Wallbox models running firmware versions prior to R8 V3.4.0.2.

💻 Affected Systems

Products:

EVlink City EVC1S22P4
EVlink City EVC1S7P4
EVlink Parking EVW2
EVlink Parking EVF2
EVlink Parking EVP2PE
EVlink Smart Wallbox EVB1A

Versions: All versions prior to R8 V3.4.0.2

Operating Systems: Embedded firmware

Default Config Vulnerable: ⚠️ Yes

Notes: All affected products with web interface enabled are vulnerable in default configurations.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could remotely control charging stations, manipulate charging parameters, disable charging functionality, or potentially cause physical damage to connected vehicles.

🟠

Likely Case

Unauthorized configuration changes, service disruption, or billing manipulation through the charging station's web interface.

🟢

If Mitigated

With proper CSRF protections and network segmentation, impact is limited to configuration changes requiring authenticated sessions.

🌐 Internet-Facing: HIGH - Charging stations with web interfaces exposed to the internet are directly vulnerable to remote exploitation.

🏢 Internal Only: MEDIUM - Internal network access still required, but CSRF attacks can be delivered through phishing or compromised internal websites.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires an authenticated user session and the ability to deliver malicious web content to the victim.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: R8 V3.4.0.2

Vendor Advisory: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02

Restart Required: Yes

Instructions:

1. Download firmware R8 V3.4.0.2 from Schneider Electric portal. 2. Backup current configuration. 3. Upload and install firmware via web interface. 4. Reboot charging station. 5. Verify firmware version.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate charging stations from untrusted networks and user workstations

CSRF Token Implementation

all

Add CSRF tokens to web forms if custom web interface modifications are possible

🧯 If You Can't Patch

Segment charging station network from general corporate network
Implement strict access controls and monitor for unauthorized configuration changes

🔍 How to Verify

Check if Vulnerable:

Check firmware version via web interface or serial console. If version is earlier than R8 V3.4.0.2, system is vulnerable.

Check Version:

Check via web interface at /cgi-bin/version or similar endpoint, or via serial console using appropriate vendor commands.

Verify Fix Applied:

Verify firmware version shows R8 V3.4.0.2 or later in web interface or via serial console.

📡 Detection & Monitoring

Log Indicators:

Unexpected configuration changes
Multiple failed login attempts followed by configuration modifications
POST requests from unusual IP addresses

Network Indicators:

HTTP POST requests to charging station web interface from non-admin workstations
Cross-origin requests to charging station endpoints

SIEM Query:

source_ip NOT IN (admin_ips) AND dest_ip IN (charging_station_ips) AND http_method = POST

📊 Metadata

CVE ID: CVE-2021-22725

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-352

Published: January 28, 2022

Last Updated: November 21, 2024

🔗 References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02 Patch,Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-348-02 Patch,Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-22725, you might also want to check these: