A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the charging station web interface by performing brute force attacks. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the charging station web interface by performing brute force attacks. Affected Products: EVlink City EVC1S22P4 / EVC1S7P4 (All versions prior to R8 V3.4.0.2 ), EVlink Parking EVW2 / EVF2 / EVP2PE (All versions prior to R8 V3.4.0.2), and EVlink Smart Wallbox EVB1A (All versions prior to R8 V3.4.0.2)

Schneider Electric is aware of multiple vulnerabilities in its EVlink City, Parking, and Smart Wallbox products. The EVlink products are electric vehicle (EV) charging stations for private properties, semi-public car parks and on-street charging. These vulnerabilities can be exploited by obtaining physical access either to the charging station’s internal communication port, which requires disassembling the charging station enclosure, or, in the case of a connected station, to the network of the charging station’s supervision system. The risk is further elevated when the connected stations are accessible over the internet and have insufficient network security measures. Customers should immediately apply the available remediations. Failure to do so may risk potential unauthorized access to the charging station’s web server, which could lead to tampering and compromise of the charging station’s settings and accounts. Such tampering could lead to things like denial of service attacks, which could result in unauthorized use of the charging station, service interruptions, failure to send charging data records to the supervision system and the modification and disclosure of the charging station’s configuration. In addition to applying the available remediations to limit the risk of a connected charging station being compromised, Schneider Electric recommends that customers follow and apply network security best practices and ensure that the charging stations are not accessible…