Critical ICSA-19-031-01 3 CVEs

Schneider Electric EVLink Parking

Published Jan 31, 2019 · Updated Jan 31, 2019

Vendor: Schneider Electric Product: EVlink Parking

Summary

Successful exploitation of these vulnerabilities could allow an attacker to stop the device and prevent charging, execute arbitrary commands, and access the web interface with full privileges.

Vulnerabilities 3

Unscored —

CVE-2018-7800

A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attack…

Schneider Electric EVLink Parking v3.2.0-12_v1 and earlier ICS / OT

Dec 24, 2018
Unscored —

CVE-2018-7801

A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maxim…

Schneider Electric EVLink Parking v3.2.0-12_v1 and earlier ICS / OT

Dec 24, 2018
Unscored —

CVE-2018-7802

A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web in…

Schneider Electric EVLink Parking v3.2.0-12_v1 and earlier ICS / OT

Dec 24, 2018

Revision history

2019-01-31 #1
ICSA-19-031-01 Schneider Electric EVLink Parking

References

ICS Advisory ICSA-19-031-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-19-031-01
Recommended Practices
https://www.cisa.gov/news-events/ics-advisories/icsa-19-031-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B