1. Home
  2. CVE Database
  3. CVE-2021-22820
CRITICAL · 9.8

CVE-2021-22820

A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the ...

Vulnerability Description

A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the legitimate user account holder has changed his password. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Schneider-ElectricEvlink City Evc1S22P4 Firmware< 3.4.0.2
Schneider-ElectricEvlink City Evc1S22P4-
Schneider-ElectricEvlink City Evc1S7P4 Firmware< 3.4.0.2
Schneider-ElectricEvlink City Evc1S7P4-
Schneider-ElectricEvlink Parking Evw2 Firmware< 3.4.0.2
Schneider-ElectricEvlink Parking Evw2-
Schneider-ElectricEvlink Parking Evf2 Firmware< 3.4.0.2
Schneider-ElectricEvlink Parking Evf2-
Schneider-ElectricEvlink Parking Evp2Pe Firmware< 3.4.0.2
Schneider-ElectricEvlink Parking Evp2Pe-
Schneider-ElectricEvlink Smart Wallbox Evb1A Firmware< 3.4.0.2
Schneider-ElectricEvlink Smart Wallbox Evb1A-

Related Weaknesses (CWE)

CWE-613

References

FAQ

What is CVE-2021-22820?

CVE-2021-22820 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the ...

How severe is CVE-2021-22820?

CVE-2021-22820 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2021-22820?

Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Evlink City Evc1S22P4 Firmware, Schneider-Electric Evlink City Evc1S22P4, Schneider-Electric Evlink City Evc1S7P4 Firmware, Schneider-Electric Evlink City Evc1S7P4, Schneider-Electric Evlink Parking Evw2 Firmware.