CVE:CVE-2021-22725
CNNVD:CNNVD-202201-2611
Schneider Electric EVlink City等都是法国施耐德电气（Schneider Electric）公司的电动汽车充电站的一款充电解决方案。
多款Schneider Electric产品存在跨站请求伪造漏洞，当向充电站web服务器发送POST请求时，恶意参数被提交，攻击者可利用该漏洞冒充用户或代表用户执行操作。以下产品及版本受到影响:EVlink City EVC1S22P4/EVC1S7P4 (R8 V3.4.0.2之前所有版本)、EVlink Parking EVW2/EVF2/EVP2PE (R8 V3.4.0.2之前所有版本)、EVlink Smart Wallbox EVB1A (R8 V3.4.0.2之前所有版本)。
solution:Upgrade schneider-electric evc1s22p4_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evc1s7p4_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evw2_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evf2_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evp2pe_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evb1a_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2)