CVE-2021-22707

What it actually does

This vulnerability is a hard-coded credential flaw in Schneider Electric EVlink City, EVlink Parking, and EVlink Smart Wallbox charging station firmware prior to R8 V3.4.0.1. Because the embedded web server accepts credentials that are built into the product rather than uniquely configured per deployment, a remote unauthenticated attacker who knows or obtains those credentials can authenticate with administrative privileges. Successful exploitation can allow full administrative control of the charging station web interface, including reading configuration data, changing operational settings, issuing unauthorized commands, disrupting charging operations, and potentially pivoting further if the charger is connected to broader management or building networks. The CVSS 9.8 rating reflects network-based exploitation, low attack complexity, no required privileges, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

Compromise of affected EV charging stations can result in charging outages, unauthorized use of charging services, tampering with station configuration, loss of operational visibility, reputational harm, and potential disruption to facilities that depend on EV charging availability. Because exploitation is reported as weaponized and EPSS is high at approximately 64.6%, exposed systems should be treated as high-priority even though the vulnerability is not currently listed in CISA KEV. Organizations operating public, semi-public, fleet, workplace, residential, or parking-garage charging infrastructure may face direct service disruption and customer-impacting failures if devices remain unpatched or reachable from untrusted networks.

How an attack unfolds

An attacker first identifies an exposed EVlink charging station web server, often through internet scanning, local network reconnaissance, or discovery of chargers on poorly segmented operational networks. The attacker then attempts authentication using the known hard-coded administrative credentials associated with vulnerable firmware. If the device is running an affected firmware version prior to R8 V3.4.0.1, the web server grants administrative access without the attacker needing a legitimate account or user interaction. From there, the attacker can issue administrative commands, modify charging station settings, interrupt charging sessions, change network or management configuration, harvest device and configuration information, and potentially use the charger as a foothold to probe adjacent systems. In a more damaging scenario, the attacker automates this process across many reachable chargers to cause widespread service disruption or unauthorized charging operations.

How to fix it

Upgrade all affected Schneider Electric EVlink City EVC1S22P4 and EVC1S7P4, EVlink Parking EVW2, EVF2, and EV.2, and EVlink Smart Wallbox EVB1A devices to firmware R8 V3.4.0.1 or later. If immediate firmware upgrade is not possible, remove the charger web management interface from internet exposure, place charging stations on a dedicated segmented network, allow management access only from trusted administrative hosts or VPNs, block inbound access from untrusted networks, and monitor for unexpected administrative activity. Rotate any configurable local, web, or management credentials after upgrade, and review device configuration for unauthorized changes. Where supported, disable unused management services, enforce strong unique credentials, and restrict access through firewall rules or network access control lists.

How to confirm the fix worked

Confirm the deployed firmware version on every affected EVlink device and verify it is R8 V3.4.0.1 or later. Validate exposure by checking external attack surface scans, firewall rules, NAT rules, VPN access paths, and internal network scans for reachable EVlink web management interfaces. Attempt only authorized administrative validation to confirm that hard-coded credentials no longer grant access and that management access is limited to approved networks. Review device configuration after remediation to ensure no unauthorized changes remain, including network settings, charging behavior, administrative users, remote management settings, and firmware integrity. Re-scan from untrusted network segments to verify the web interface is not reachable except through approved management paths.

Typical attack path

1. Scan the internet, facility network, or parking/charging network segment for exposed EVlink charging station web interfaces.
2. Fingerprint the device model and firmware family through banners, login pages, certificates, HTTP responses, or management interface metadata.
3. Attempt access using the hard-coded administrative credentials known for vulnerable EVlink firmware.
4. Authenticate to the charging station web server with administrative privileges.
5. Issue unauthorized administrative commands or change station configuration.
6. Disrupt charging operations, enable unauthorized use, collect configuration data, or alter network settings.
7. Optionally pivot from the compromised charger into adjacent management, facility, or operational networks if segmentation is weak.

How to detect it

Investigate whether EVlink web management interfaces were reachable from the internet or from untrusted internal networks during the exposure window. Review charger web server logs, administrative audit logs, device event logs, syslog exports, network firewall logs, VPN logs, NAC records, and proxy or IDS telemetry for connections to EVlink management ports from unfamiliar IP addresses. Look for successful administrative logins that do not correspond to maintenance windows, repeated login attempts followed by configuration changes, unexpected reboots, altered network settings, charging-session interruptions, firmware or configuration modifications, and new or changed administrator accounts where the device supports account management. Correlate access timestamps with physical charging outages, customer complaints, abnormal charging-session records, and network scans. Because this issue involves hard-coded credentials and no unique public exploit artifact is provided, absence of a distinctive payload string does not rule out compromise; prioritize behavioral evidence such as unauthorized admin access and configuration drift.

What your security team should do

• Immediately inventory all Schneider Electric EVlink City, EVlink Parking, and EVlink Smart Wallbox devices and record model, firmware version, network location, and management exposure.
• Prioritize upgrade of all affected devices to firmware R8 V3.4.0.1 or later, especially chargers exposed to the internet or reachable from shared/public networks.
• Until upgrades are complete, block untrusted access to EVlink web management interfaces and restrict administration to a dedicated management network or VPN.
• Search historical logs and network telemetry for unexpected administrative logins, configuration changes, reboot events, command execution, or access from unfamiliar IP addresses.
• After patching, rotate configurable credentials, review all charger settings, and restore known-good configuration baselines where available.
• Implement durable segmentation for EV charging infrastructure so compromised chargers cannot reach corporate, facility-management, payment, or other operational systems.
• Add periodic vulnerability and exposure checks for EV charging assets to external attack surface management and internal scanning programs.