Security Advisory

CVE-2021-22707: Schneider Electric EVlink EV Charger Hard-Coded Credentials Authentication Bypass

Last updated:
  • CVE-2021-22707

CVE-2021-22707 is a hard-coded credentials vulnerability (CWE-798) in the administration web interface of Schneider Electric's EVlink City, EVlink Parking and EVlink Smart Wallbox EV charging stations: a remote attacker can authenticate using undocumented, hard-coded HTTP cookie values and issue administrative commands to the charging station's web server without any legitimate credentials, and NVD's own analysis rates the flaw 9.8 (critical) on CVSS v3.1 — slightly higher than Schneider's own 9.4 rating for the same vector.

Vulnerability summary

9.8

Critical

64.6%

EPSS score (FIRST)

No

CISA KEV catalog

2021-07-21

Published

Vulnerability ID: CVE-2021-22707 · Source: NVD

Affected components

ComponentCPEVersion range
Schneider Electric EVlink City / EVlink Parking / EVlink Smart Wallbox (EV charging station web management interface)—EVlink City (EVC1S22P4 / EVC1S7P4), EVlink Parking (EVW2 / EVF2 / EV.2) and EVlink Smart Wallbox (EVB1A), all versions prior to Firmware R8 V3.4.0.1; fixed in Firmware R8 V3.4.0.1, per Schneider Electric Security Notification SEVD-2021-194-06

What does this mean for affected devices?

CVE-2021-22707 (CWE-798, Use of Hard-coded Credentials) affects the administration web interface of three Schneider Electric EV charging station product lines. NVD's description states: "A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1) that could allow an attacker to issue unauthorized commands to the charging station web server with administrative privileges" (NVD).

Schneider Electric's own Security Notification SEVD-2021-194-06, published 13 July 2021 alongside twelve other EVlink vulnerabilities, describes the same flaw and scores it 9.4 (critical) on CVSS v3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L — a slightly lower availability-impact rating (A:L) than NVD's own Primary analysis, which rates the full vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H at 9.8 (A:H, full availability impact). The bulletin credits researchers Wu Ming (BaCde) and Chen Huajiang (Kevin2600) for identifying this flaw together with the related firmware-signature bypass CVE-2021-22708, and lists Firmware R8 V3.4.0.1 as the fix for all three affected product lines (Schneider Electric Security Notification SEVD-2021-194-06).

An independent advisory from SEC Consult, a security research firm, separately documents this same vulnerability as an "Authentication Bypass with Hard Coded Credentials" in EVlink City, Parking and Smart Wallbox firmware R7 (V3.3.0.15), stating that "the authentication for the EVlink administration web interface can be bypassed with undocumented and hard coded HTTP cookie values," and notes it can be chained with the companion firmware-signing flaw to achieve full remote code execution on the charging station (SEC Consult advisory).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, but FIRST scores the probability of exploitation unusually high for an advisory this old, at 0.64612 (99.2th percentile) as of 2026-11-08 — consistent with the flaw being both easy to exploit (no authentication, no user interaction) and well documented across multiple independent public advisories years after disclosure (CISA KEV, FIRST EPSS).

Operators still running EVlink City, EVlink Parking or EVlink Smart Wallbox stations on firmware older than R8 V3.4.0.1 should update immediately, and should not rely on network placement alone: Schneider Electric's bulletin recommends restricting access to the charging station's web server to trusted networks in addition to applying the firmware update, since a charging station's supervision network is frequently reachable from the wider internet in public and semi-public deployments.

How to fix this class of issueThis advisory's weakness class is Hard-coded credentials. Our practical guide covers how to detect, fix, verify and disclose it: How to fix hard-coded credentials in embedded firmware.

Evidence

  • A CWE-798 Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1) that could allow an attacker to issue unauthorized commands to the charging station web server with administrative privileges. — NVD
  • Schneider's own CVSS v3.1 score is 9.4 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L; credited to Wu Ming (BaCde) and Chen Huajiang (Kevin2600); fixed in Firmware R8 V3.4.0.1. — Schneider Electric Security Notification SEVD-2021-194-06
  • Authentication for the EVlink administration web interface can be bypassed with undocumented and hard-coded HTTP cookie values, affecting firmware R7 (V3.3.0.15); can be chained with the firmware-signing bypass to achieve remote code execution. — SEC Consult advisory
  • NVD's own Primary CVSS v3.1 score is 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
  • Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.64612 (99.2th percentile) as of 2026-11-08. — FIRST EPSS

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2021-33016: KUKA KR C4 Robot Controller Hard-Coded Credentials — CVSS 9.8, Critical severityCVE-2021-33016: hard-coded credentials in KUKA System Software (KSS) running on KR C4 robot controllers let an attacker gain full read/write/delete access to sensitive folders. NVD and CISA both rate it 9.8 (critical).CVE-2022-2107: MiCODUS MV720 GPS Vehicle Tracker Hard-Coded Master Password — CVSS 9.8, Critical severityCVE-2022-2107: the MiCODUS MV720 GPS vehicle tracker's API server accepts a hard-coded master password, letting an attacker send SMS commands to the device as if they came from the owner's own phone number, including fuel-cutoff. NVD Primary CVSS 9.8; sourced to NVD, CISA and FIRST EPSS.CVE-2023-6448: Unitronics Vision/Samba PLC & HMI Default Password Takeover (KEV, Water Sector Attacks) — CVSS 9.8, Critical severityCISA KEVCVE-2023-6448: KEV insecure default administrative password on Unitronics Vision/Samba PLCs and HMIs, exploited against US water utilities. Versions, patches, scoring, sourced to NVD, CISA and Unitronics.

Sources

  1. NVD
  2. Schneider Electric Security Notification SEVD-2021-194-06
  3. SEC Consult advisory
  4. CISA KEV
  5. FIRST EPSS