Schneider Electric EVLink WallBox OS Command Injection Vulnerability Allowing Remote Control

An OS command injection vulnerability has been identified in the Schneider Electric EVLink WallBox, all versions. This vulnerability allows remote control over the charging station when an authenticated user modifies configuration parameters on the web server.

Impact

Exploitation of this vulnerability could lead to unauthorized remote control of the charging station.

Remediation

The EVLink WallBox has reached its end of life and is no longer supported. Customers are advised to upgrade to the EVLink Pro AC. For those who continue to use the WallBox, it is recommended to implement network segmentation, block unauthorized access to HTTP ports, choose strong passwords, and change them periodically.