Schneider Electric EVLink Parking

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: EVLink Parking Vulnerabilities: Use of Hard-coded Credentials, Code Injection, SQL Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could...

SQL Injection Vulnerability in Water Marketing Management System and Gas Charging Management System

Chengdu Tongfei Technology Co., Ltd. is a high-tech enterprise focusing on the development of application software and information system integration services in the public utilities industry, and has long been committed to providing intelligent gas, intelligent water, intelligent pipeline networ...

Critical Bug Patched in Schneider Electric Vehicle Charging Station

Schneider Electric is warning about a critical vulnerability in its EVLink Parking devices – a line of electric vehicle charging stations. The energy management and automation giant said the vulnerability is tied to a hard-coded credential bug that exists within the device that could enable...

Electric Vehicle Charging Stations Open to IoT Attacks

UPDATE Given that creating proof-of-concept PoC cyberattacks for the Internet of Things IoT is essentially like shooting fish in a barrel these days, perhaps it’s not exactly surprising that a new niche category has proven to present a fresh attack surface: electric vehicle EV charging stations...

Bad Consumer Security Advice

There are lots of articles about there telling people how to better secure their computers and online accounts. While I agree with some of it, this article contains some particularly bad advice: 1. Never, ever, ever use public unsecured Wi-Fi such as the Wi-Fi in a café, hotel or airport. To...

CirCarlife Scada Information Disclosure Vulnerability (CNVD-2018-19569)

CIRCONTROL CirCarLife is a parking lot automation management system from Circontrol, Spain. A security vulnerability exists in CIRCONTROL CirCarLife versions prior to 4.3 that stems from the program's lack of authentication of the /html/devstat.html file. A remote attacker could exploit the...

Information leakage vulnerability in multiple Huawei phones

Huawei Berlin-L21HN and Prague-AL00A are smartphone products of Huawei China. Several Huawei phones are vulnerable to information leakage. When a user connects a dangerous charging device to charge the phone, an unauthenticated attacker opens specific features of the phone by sending a carefully...

USB Accessory Can Defeat iOS's New "USB Restricted Mode" Security Feature

With the release of iOS 11.4.1, Apple has finally rolled out a new security feature designed to protect your devices against USB accessories that connect to the data port, making it harder for law enforcement and hackers to break into your iPhone or iPad without your permission. Dubbed USB...

CVE-2018-7778

In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users...

CVE-2018-7778

In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users...

Design/Logic Flaw

In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users...

CVE-2018-7778

In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users...

CVE-2018-7778

Schneider Electric Evlink Charging Station Web Interface, prior to version 3.2.0-12_v1, is vulnerable to remote privilege escalation due to improper authentication, allowing a remote attacker to gain administrative privileges. Root cause: failure to properly authenticate remote users. Affected pr...

Input validation

Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before...

CVE-2017-17158

Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before...

CVE-2017-17158

The CVE-2017-17158 entry concerns Huawei smartphones (Berlin-L21HNC185B381; Prague-AL00A/B/C/TL00 variants) with an information-exposure vulnerability. The issue arises when a user’s phone connects to a malicious charging device; via specially crafted messages, an unauthenticated attacker may tri...

CVE-2018-0089

A vulnerability in the Policy and Charging Rules Function PCRF of the Cisco Policy Suite CPS could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The attacker would also have to have access ...

CVE-2018-0089

A vulnerability in the Policy and Charging Rules Function PCRF of the Cisco Policy Suite CPS could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The attacker would also have to have access ...

Override Access Vulnerability in Charging Pile Android App

Charging Pile APP is a software that provides electric vehicle owners with information service on the location, number, type and status of charging piles. The Charging Pile Android APP suffers from an overstepping access vulnerability that allows attackers to view arbitrary account information by...

Charging Pile Android App has Arbitrary Account Password Reset Vulnerability

Charging Pile APP is a software that provides electric vehicle owners with information service on the location, number, type and status of charging piles. Charging Pile Android APP has an arbitrary account password reset vulnerability. Allowing an attacker to reset a user's password by captcha...