Schneider Electric Evlink Parking EVW2 Firmware vulnerabilities

18 CVEs affecting Schneider Electric Evlink Parking EVW2 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22822, published 2022-01-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22707, published 2021-07-21. Critical severity, CVSS 9.8. EPSS: 64.6% chance of exploitation in the next 30 days. A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8…
CVE-2021-22729, published 2021-07-21. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8…
CVE-2021-22727, published 2021-07-21. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1),…
CVE-2021-22730, published 2021-07-21. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8…
CVE-2021-22820, published 2022-01-28. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the…
CVE-2021-22728, published 2021-07-21. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1),…
CVE-2021-22818, published 2022-01-28. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the charging station web interface by performing…
CVE-2021-22726, published 2021-07-21. High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days. A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8…
CVE-2021-22721, published 2021-07-21. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1),…
CVE-2021-22773, published 2021-07-21. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8…

Latest

CVE-2021-22822, published 2022-01-28. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. A CWE-79 Improper Neutralization of Input During Web Page Generation (�Cross-site Scripting�) vulnerability exists that could allow an attacker to impersonate the user who manages the charging…
CVE-2021-22821, published 2022-01-28. High severity, CVSS 8.6. EPSS: 0.8% chance of exploitation in the next 30 days. A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious parameters are…
CVE-2021-22819, published 2022-01-28. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use…
CVE-2021-22774, published 2021-07-21. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to…