In a security alert, Schneider Electric confirmed the detection and fix of various vulnerabilities residing in EVlink EV charging stations, which could expose these deployments to malicious hackers. To be specific, the faults reside in the EVlink City (EVC1S22P4 and EVC1S7P4), Parking (EVW2, EVF2 and EVP2PE) and Smart Wallbox (EVB1A) equipment, in addition to other products that will no longer be supported.
Among the vulnerabilities addressed, cross-site request forgery (CSRF) and cross-site scripting (XSS) flaws stand out, which could be exploited to deploy actions impersonating legitimate users; in addition, a vulnerability was addressed that could give attackers full access to charging stations via brute force attacks. The most severe of the flaws received a score of 9.3/10 according to the Common Vulnerability Scoring System (CVSS).
The company warns that exploiting the critical flaw could lead to severe risk scenarios: “Malicious manipulation of charging stations could lead to denial of service (DoS) attacks, deregistration, and disclosure of sensitive information,” Schneider’s notice states. Exploiting most of these vulnerabilities would require physical access to the system’s internal communication ports, although some complex attacks can be exploited remotely over the Internet.
Tony Nasr, a researcher who initially reported the vulnerabilities, mentions that the bugs involve sending specially crafted requests and exploitation does not require interaction from vulnerable users: “Attacks allow threat actors to exploit compromised EVCS in a similar way to the operation of a botnet, allowing the deployment of various attacks.” However, exploiting the CSRF and XSS vulnerabilities requires specific levels of user interaction.
The researcher adds that while the most dangerous attack vector points to Internet-oriented EVlink implementations, cybercriminals could still create a severe security risk for these stations over LAN, as the EVlink configuration requires network connectivity for remote control and more efficient management.
Nasr concluded by mentioning that these vulnerabilities were found as part of a larger study on electric vehicle charging station management systems. Full results of the study will be available in the coming months.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
