1. Home
  2. CVE Database
  3. CVE-2021-22725
HIGH · 8.8

CVE-2021-22725

A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitt...

Vulnerability Description

A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitted in POST requests sent to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Schneider-ElectricEvc1S22P4 Firmware< 3.4.0.2
Schneider-ElectricEvc1S22P4-
Schneider-ElectricEvc1S7P4 Firmware< 3.4.0.2
Schneider-ElectricEvc1S7P4-
Schneider-ElectricEvw2 Firmware< 3.4.0.2
Schneider-ElectricEvw2-
Schneider-ElectricEvf2 Firmware< 3.4.0.2
Schneider-ElectricEvf2-
Schneider-ElectricEvp2Pe Firmware< 3.4.0.2
Schneider-ElectricEvp2Pe-
Schneider-ElectricEvb1A Firmware< 3.4.0.2
Schneider-ElectricEvb1A-

Related Weaknesses (CWE)

CWE-352

References

FAQ

What is CVE-2021-22725?

CVE-2021-22725 is a vulnerability with a CVSS score of 8.8 (HIGH). A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitt...

How severe is CVE-2021-22725?

CVE-2021-22725 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-22725?

Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Evc1S22P4 Firmware, Schneider-Electric Evc1S22P4, Schneider-Electric Evc1S7P4 Firmware, Schneider-Electric Evc1S7P4, Schneider-Electric Evw2 Firmware.