Schneider Electric EVLink Parking
Advisory ansehen veröffentlicht 2019-01-31
Successful exploitation of these vulnerabilities could allow an attacker to stop the device and prevent charging, execute arbitrary commands, and access the web interface with full privileges.
01
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-7802US | high8.8 | — | ||
A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full privileges. | ||||
| CVE-2018-7801US | high8.8 | — | ||
A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when a remote code execution is performed. | ||||
| CVE-2018-7800US | critical9.8OT erhöht | — | ||
A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSA-19-031-01 JSONself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
Behebungen (3)
- MitigationEVLink Parking
All controllers should reside in locked cabinets and never be left in the “Program” mode.
- MitigationEVLink Parking
All controllers should reside in locked cabinets and never be left in the “Program” mode.
- MitigationEVLink Parking
All controllers should reside in locked cabinets and never be left in the “Program” mode.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan