CVE:CVE-2021-22822
CNNVD:CNNVD-202201-2617
Schneider Electric EVlink City等都是法国施耐德电气（Schneider Electric）公司的电动汽车充电站的一款充电解决方案。
多款Schneider Electric产品存在跨站脚本漏洞，该漏洞允许攻击者冒充管理充电站的用户，或精心设计的恶意参数被提交到充电站web服务器时代表用户执行操作。以下产品及版本受到影响：EVlink City EVC1S22P4 / EVC1S7P4 (R8 V3.4.0.2之前所有版本 ), EVlink Parking EVW2 / EVF2 / EVP2PE (R8 V3.4.0.2之前的所有版本),  EVlink Smart Wallbox EVB1A ( R8 V3.4.0.2之前的所有版本) 。
solution:Upgrade schneider-electric evlink_city_evc1s22p4_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evlink_city_evc1s7p4_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evlink_parking_evw2_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evlink_parking_evf2_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evlink_parking_evp2pe_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2); Upgrade schneider-electric evlink_smart_wallbox_evb1a_firmware to a higher version than 3.4.0.2,and avoid the version (,3.4.0.2)