Schneider Electric EVLink WallBox Path Traversal Vulnerability Allowing Arbitrary File Writes

A path traversal vulnerability has been identified in the Schneider Electric EVLink WallBox, all versions. This vulnerability, categorized as CWE-22, allows an unauthenticated user to manipulate file paths, potentially leading to arbitrary file writes on the web server.

Impact

Exploitation of this vulnerability could result in unauthorized file writes, with potential consequences depending on the nature of the files written.

Remediation

The EVLink WallBox has reached its end of life and is no longer supported. Customers are advised to upgrade to the EVLink Pro AC. For those who continue to use the WallBox, it is recommended to implement network segmentation, block unauthorized access to HTTP ports, choose strong passwords, and change them periodically.