A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parkin…

published 2021-07-21 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-9863

cvss: 6.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits: 0; none known

A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could cause disclosure of encrypted credentials when consulting the maintenance report.

Patch / fix

fixed in 6

schneider-electric evlink_city_evc1s22p4_firmware r8_v3.4.0.1
schneider-electric evlink_city_evc1s7p4_firmware r8_v3.4.0.1
schneider-electric evlink_parking_evw2_firmware r8_v3.4.0.1
schneider-electric evlink_parking_evf2_firmware r8_v3.4.0.1
schneider-electric evlink_parking_ev.2_firmware r8_v3.4.0.1
schneider-electric evlink_smart_wallbox_evb1a_firmware r8_v3.4.0.1

Exploit prediction

1.07% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

n/a EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

download.schneider-electric.com /files?p_Doc_Ref=SEVD-2021-194-06
vendor-advisory

Sources

CVE List CVE-2021-22728
NVD CVE-2021-22728

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary