Schneider Electric EVLink Parking
view advisory published 2019-01-31
Successful exploitation of these vulnerabilities could allow an attacker to stop the device and prevent charging, execute arbitrary commands, and access the web interface with full privileges.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-7802US | high8.8 | — | ||
A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full privileges. | ||||
| CVE-2018-7801US | high8.8 | — | ||
A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when a remote code execution is performed. | ||||
| CVE-2018-7800US | critical9.8OT elevated | — | ||
A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device. | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-19-031-01 JSONself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (3)
- MitigationEVLink Parking
All controllers should reside in locked cabinets and never be left in the “Program” mode.
- MitigationEVLink Parking
All controllers should reside in locked cabinets and never be left in the “Program” mode.
- MitigationEVLink Parking
All controllers should reside in locked cabinets and never be left in the “Program” mode.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan