A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain attacks based on same-origin policy or cross-site request forgery protections bypass. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)

A CWE-942: Permissive Cross-domain Policy with Untrusted Domains vulnerability exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain attacks based on same-origin policy or cross-site request forgery protections bypass. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System) products. The EcoStruxure EV Charging Expert products are load management, access management and supervision solutions for EV charging infrastructure. Failure to apply the available remediations may risk potential unauthorized access to the product’s web server, which could lead to tampering and compromise of the product’s settings and accounts. Such tampering could lead to things like denial of service attacks, which could result in unauthorized use of the managed EV charging stations, service interruptions, failure to communicate with the supervision system and the modification and disclosure of the product’s configuration. In addition to applying the available remediations, to limit the risk of a product being compromised, Schneider Electric recommends that customers follow and apply network security best practices and ensure that the products are not accessible from the internet, as outlined in the General Security Recommendations section