What is CVE-2021-22724?

CVE-2021-22724 is a high-severity vulnerability in Schneider-Electric Evb1a, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2022-01-28.

How severe is CVE-2021-22724?

High severity. CVSS v3 base score is 8.8 out of 10.

CSRF in Schneider-Electric Evb1a

CVE-2021-22724

A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitted in POST requests sent to the charging station web server. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.005 (38.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

cybersecurity@se.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-22724?: CVE-2021-22724 is a high-severity vulnerability in Schneider-Electric Evb1a, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2022-01-28.
How severe is CVE-2021-22724?: High severity. CVSS v3 base score is 8.8 out of 10.