Successful exploitation of these vulnerabilities could allow an attacker to gain remote control of the charging station.
Schneider Electric reports that the following products are affected:
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability exists, which could cause arbitrary file writes when an unauthenticated user on the web server manipulates the file path.
CVE-2025-5740 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.2 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-5740. A base score of 8.6 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability exists, which could cause arbitrary file reads from the charging station. Exploitation of this vulnerability requires an authenticated session of the web server.
CVE-2025-5741 has been assigned to this vulnerability. A CVSS v3.1 base score of 4.9 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2025-5741. A base score of 6.9 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N).
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability exists when an authenticated user modifies the configuration parameters on the web server.
CVE-2025-5742 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.4 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
A CVSS v4 score has also been calculated for CVE-2025-5742. A base score of 5.1 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N).
An improper neutralization of special elements used in an OS command ('OS command injection') vulnerability exists, which could cause remote control of the charging station when an authenticated user modifies configuration parameters on the web server.
CVE-2025-5743 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N).
A CVSS v4 score has also been calculated for CVE-2025-5743. A base score of 7.0 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N).
Dutch Institute for Vulnerability Disclosure (DIVD) reported these vulnerabilities to Schneider Electric.
According to Schneider Electric, EVLink WallBox product has reached its end of life and is no longer supported. Users should also consider upgrading to the replacement product offering EVLink Pro AC to resolve these issues. Users should immediately apply the following mitigations to reduce the risk of exploit:
For more information see the associated Schneider Electric CPCERT security advisory SEVD-2025-161-03 EVLink WallBox - SEVD-2025-161-03 PDF Version, EVLink WallBox - SEVD-2025-161-03 CSAF Version.
Schneider Electric strongly recommends the following industry cybersecurity best practices.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.