Schneider Electric Evlink Parking EVP2PE Firmware vulnerabilities

5 CVEs affecting Schneider Electric Evlink Parking EVP2PE Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22822, published 2022-01-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22820, published 2022-01-28. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the…
CVE-2021-22818, published 2022-01-28. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the charging station web interface by performing…
CVE-2021-22821, published 2022-01-28. High severity, CVSS 8.6. EPSS: 0.8% chance of exploitation in the next 30 days. A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious parameters are…
CVE-2021-22819, published 2022-01-28. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use…
CVE-2021-22822, published 2022-01-28. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. A CWE-79 Improper Neutralization of Input During Web Page Generation (�Cross-site Scripting�) vulnerability exists that could allow an attacker to impersonate the user who manages the charging…