Summary
Schneider Electric is aware of a vulnerability with the potential disclosure of confidential
information in its EVlink Home Smart and Schneider Charge charging stations.
This is not related to any of the customer personal data and potential disclosure cannot be
exploited to abuse both products. This only relates to remote test equipment and test features
that are removed from production units.
A remediation for affected charging stations has already been deployed to all connected units.
Vulnerabilities 1
-
High 8.5
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware …
Revision history
-
#1.0.0
Original Release
References
-
EVlink Home Smart and Schneider Charge - SEVD-2024-282-04 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-282-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2024-282-04.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-25-023-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-03
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B