CVE-2018-7800

Vulnerability

CVE-2018-7800 is a use of hard-coded credentials vulnerability (CWE-798) in Schneider Electric EVLink Parking, an electric vehicle charging station. All versions up to and including 3.2.0-12_v1 are affected. The firmware contains embedded credentials that are not changeable by the user, enabling an attacker to bypass authentication entirely.

Exploitation

An unauthenticated attacker with network access to the EVLink Parking device can exploit the hard-coded credentials remotely. No user interaction or privileged access is required. By leveraging the known credentials, the attacker can authenticate to the device's management interface with full privileges.

Impact

Successful exploitation allows the attacker to gain complete control of the EVLink Parking unit. The adversary can stop the device (denial of charging), execute arbitrary commands, and access the web interface with maximum privileges, resulting in compromise of confidentiality, integrity, and availability.

Mitigation

Schneider Electric has not released a fixed version in the available references [1]. The advisory recommends users apply general security best practices such as restricting network access and monitoring for unusual activity. No specific patch version date is provided. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the advisory date.