PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-8070 Schneider Electric CVE debrief

A high-severity vulnerability (CVSS 8.5) in Schneider Electric EVlink Home Smart and Schneider Charge products exposes test credentials in cleartext within firmware binaries. The CWE-312 flaw allows local attackers with physical or logical access to extract sensitive authentication material from firmware images. Schneider Electric has released automatic firmware updates through the Wiser application and eSetup commissioning tool to remediate affected devices.

Vendor
Schneider Electric
Product
EVlink Home Smart
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-10-08
Original CVE updated
2024-10-08
Advisory published
2024-10-08
Advisory updated
2024-10-08

Who should care

Owners and operators of Schneider Electric EVlink Home Smart and Schneider Charge electric vehicle charging stations, facility managers with EV infrastructure, industrial control system security teams, and organizations managing distributed EV charging deployments.

Technical summary

CVE-2024-8070 is a CWE-312 (Cleartext Storage of Sensitive Information) vulnerability affecting Schneider Electric EVlink Home Smart (all versions prior to 2.0.6.0.0) and Schneider Charge (all versions prior to 1.13.4). The vulnerability exposes test credentials stored in cleartext within firmware binaries, potentially allowing attackers with local access to extract authentication material. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) reflects local attack vector, low complexity, no privileges required, no user interaction, changed scope, high confidentiality impact, and low integrity/availability impact. Schneider Electric has deployed automatic firmware updates through the Wiser application; new installations receive fixes through the eSetup commissioning application.

Defensive priority

HIGH

Recommended defensive actions

  • Verify EVlink Home Smart firmware is updated to version 2.0.6.0.0 or later through the Wiser application settings page
  • Verify Schneider Charge firmware is updated to version 1.13.4 or later through the Wiser application or third-party supervision application
  • Ensure charging stations remain connected to the Wiser application to receive automatic security updates
  • For new installations, use the eSetup commissioning application which enforces the security fix
  • Review CISA ICS recommended practices for securing industrial control systems and EV charging infrastructure
  • Monitor Schneider Electric security advisories for additional updates to SEVD-2024-282-04

Evidence notes

CISA ICS advisory ICSA-25-023-03 documents this vulnerability with vendor confirmation from Schneider Electric. The advisory specifies affected firmware versions and automatic update mechanisms.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-8070 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-8070

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-8070 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-8070

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-023-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.se.com/us/en/download/document/7EN52-0390/

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.