Vulnerabilities > CVE-2021-22774 - Use of Password Hash With Insufficient Computational Effort vulnerability in Schneider-Electric products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

schneider-electric

CWE-916

NVD

Published: 2021-07-21

Updated: 2024-11-21

Summary

A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could lead an attacker to get knowledge of charging station user account credentials using dictionary attacks techniques.

Vulnerable Configurations

Part	Description	Count
OS	Schneider-Electric Schneider Electric Evlink City Evc1S22P4 Firmware - Schneider Electric Evlink City Evc1S7P4 Firmware - Schneider Electric Evlink Parking Evw2 Firmware - Schneider Electric Evlink Parking Evf2 Firmware - Schneider Electric Evlink Parking Ev.2 Firmware - Schneider Electric Evlink Smart Wallbox Evb1A Firmware -	6
Hardware	Schneider-Electric Schneider Electric Evlink City Evc1S22P4 - Schneider Electric Evlink City Evc1S7P4 - Schneider Electric Evlink Parking Evw2 - Schneider Electric Evlink Parking Evf2 - Schneider Electric Evlink Parking Ev.2 - Schneider Electric Evlink Smart Wallbox Evb1A -	6

Common Weakness Enumeration (CWE)

CWE-916 - Use of Password Hash With Insufficient Computational Effort

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References