CVE-2021-22729 – This vulnerability allows attackers to gain adm... (How to Fix)

Q: What is the severity of CVE-2021-22729?

CVE-2021-22729 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows attackers to gain administrative access to Schneider Electric EVlink charging stations by exploiting hard-coded passwords in the web server. Affected products include EVlink City, EVlink Parking, and EVlink Smart Wallbox charging stations running versions prior to R8 V3.4.0.1.

📋 TL;DR

This vulnerability allows attackers to gain administrative access to Schneider Electric EVlink charging stations by exploiting hard-coded passwords in the web server. Affected products include EVlink City, EVlink Parking, and EVlink Smart Wallbox charging stations running versions prior to R8 V3.4.0.1.

💻 Affected Systems

Products:

EVlink City (EVC1S22P4, EVC1S7P4)
EVlink Parking (EVW2, EVF2, EV.2)
EVlink Smart Wallbox (EVB1A)

Versions: All versions prior to R8 V3.4.0.1

Operating Systems: Embedded firmware

Default Config Vulnerable: ⚠️ Yes

Notes: All affected products use the same vulnerable firmware architecture with hard-coded administrative credentials.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of charging station allowing attackers to disable charging, manipulate billing, access connected networks, or cause physical damage through electrical manipulation.

🟠

Likely Case

Unauthorized administrative access enabling attackers to disrupt charging operations, steal user data, or use the station as an entry point to connected networks.

🟢

If Mitigated

Limited impact if stations are isolated from critical networks and monitored for unauthorized access attempts.

🌐 Internet-Facing: HIGH - Charging stations are often internet-connected for remote management, making them directly accessible to attackers.

🏢 Internal Only: MEDIUM - Even internally networked stations are vulnerable to insider threats or compromised internal systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only knowledge of the hard-coded password and network access to the web interface.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: R8 V3.4.0.1

Vendor Advisory: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06

Restart Required: Yes

Instructions:

1. Download firmware R8 V3.4.0.1 from Schneider Electric portal. 2. Backup current configuration. 3. Upload and install new firmware via web interface. 4. Verify installation and restore configuration if needed.

🔧 Temporary Workarounds

Network Isolation

all

Isolate charging stations from internet and critical internal networks using VLANs or firewalls.

Access Control Lists

all

Restrict web interface access to authorized management IP addresses only.

🧯 If You Can't Patch

Implement strict network segmentation to isolate charging stations from critical systems
Monitor for unauthorized access attempts and implement alerting for administrative login events

🔍 How to Verify

Check if Vulnerable:

Check firmware version in web interface under System Information. If version is earlier than R8 V3.4.0.1, system is vulnerable.

Check Version:

Access web interface and navigate to System Information page

Verify Fix Applied:

Verify firmware version shows R8 V3.4.0.1 or later in System Information. Test that hard-coded password no longer works.

📡 Detection & Monitoring

Log Indicators:

Multiple failed login attempts followed by successful login
Administrative access from unexpected IP addresses
Configuration changes without authorized change tickets

Network Indicators:

HTTP requests to /login or administrative endpoints from unauthorized sources
Unusual outbound connections from charging stations

SIEM Query:

source="evlink_web_logs" AND (event="login_success" OR event="admin_access") AND NOT src_ip IN authorized_management_ips

📊 Metadata

CVE ID: CVE-2021-22729

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-259

Published: July 21, 2021

Last Updated: November 21, 2024

🔗 References

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06 Vendor Advisory
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06 Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-22729, you might also want to check these: