CVE:CVE-2021-22820
CNNVD:CNNVD-202201-2615
Schneider Electric EVlink City等都是法国施耐德电气（Schneider Electric）公司的电动汽车充电站的一款充电解决方案。
多款Schneider Electric产品存在安全漏洞，该漏洞允许攻击者在合法用户帐户更改了密码后，仍然可以通过劫持的会话对充电站web服务器进行未经授权的访问。以下产品及版本受到影响:EVlink City EVC1S22P4/EVC1S7P4 (R8 V3.4.0.2之前所有版本)、EVlink Parking EVW2/ EVF2/ EVP2PE (R8 V3.4.0.2之前所有版本)、EVlink Smart Wallbox EVB1A (R8 V3.4.0.2之前所有版本)。
solution:Upgrade schneider-electric evlink_city_evc1s22p4_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evlink_city_evc1s7p4_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evlink_parking_evw2_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evlink_parking_evf2_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evlink_parking_evp2pe_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evlink_smart_wallbox_evb1a_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2)