CSRF in Schneider-Electric Hmibscea53d1edb
CVE-2022-22808
A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain attacks based on same-origin policy or cross-site request forgery protections bypass. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.007 (48.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Schneider-electric Hmibscea53d1edb
- Schneider-electric Hmibscea53d1edb_firmware
- Schneider-electric Hmibscea53d1edl
- Schneider-electric Hmibscea53d1edl_firmware
- Schneider-electric Hmibscea53d1edm
- Schneider-electric Hmibscea53d1edm_firmware
- Schneider-electric Hmibscea53d1eds
- Schneider-electric Hmibscea53d1eds_firmware
- Schneider-electric Hmibscea53d1eml
- Schneider-electric Hmibscea53d1eml_firmware
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cybersecurity@se.com (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-22808?
- CVE-2022-22808 is a high-severity vulnerability in Schneider-Electric Hmibscea53d1edb, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2022-02-09.
- How severe is CVE-2022-22808?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2022-22808 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.