A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink…

published 2021-07-21 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-9864

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 0; none known

A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could allow an attacker to gain unauthorized administrative privileges when accessing to the charging station web server.

Patch / fix

fixed in 6

schneider-electric evlink_city_evc1s22p4_firmware r8_v3.4.0.1
schneider-electric evlink_city_evc1s7p4_firmware r8_v3.4.0.1
schneider-electric evlink_parking_evw2_firmware r8_v3.4.0.1
schneider-electric evlink_parking_evf2_firmware r8_v3.4.0.1
schneider-electric evlink_parking_ev.2_firmware r8_v3.4.0.1
schneider-electric evlink_smart_wallbox_evb1a_firmware r8_v3.4.0.1

Exploit prediction

1.79% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

n/a EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 )

Classification

Weakness

CWE-259 Use of Hard-coded Password

References

download.schneider-electric.com /files?p_Doc_Ref=SEVD-2021-194-06
vendor-advisory

Sources

CVE List CVE-2021-22729
NVD CVE-2021-22729

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary