CVE-2025-5740 Schneider Electric CVE debrief

Who should care

Operators and asset owners running Schneider Electric EVLink WallBox, OT or facility security teams, administrators of shared web interfaces, and anyone responsible for network segmentation and firewall controls around EV charging equipment.

Technical summary

The source advisory identifies a CWE-22 improper limitation of a pathname to a restricted directory. Impact is arbitrary file writes when an authenticated user manipulates a file path on the web server. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, which aligns with a network-reachable issue that still requires high privileges. The advisory revision history shows the initial release on 2025-06-10 and a 2025-07-08 update clarifying the attacker must be authenticated. Affected product scope is Schneider Electric EVLink WallBox all versions.

Defensive priority

High. Prioritize any exposed or shared-admin EVLink WallBox deployment, especially where HTTP access is not tightly segmented. Because the product is end of life and no fix is planned, containment and replacement should be treated as urgent.

Recommended defensive actions

• Restrict access to the device web interface; block unauthorized HTTP access with firewalls and network segmentation.
• Review access logs periodically for suspicious or unexpected web administration activity.
• Enforce strong unique passwords and avoid shared credentials for any authenticated web access.
• Treat affected EVLink WallBox systems as end-of-life assets and plan migration to Schneider Electric EVLink Pro AC.
• Validate that compensating controls are in place wherever the product remains deployed, since no vendor fix is planned for EVLink WallBox.

Evidence notes

The CISA CSAF advisory ICSA-25-175-04 names Schneider Electric EVLink WallBox all versions as affected and describes the issue as CWE-22 path traversal causing arbitrary file writes. The revision history explicitly states that the 2025-07-08 update clarified attacker authentication is required. The advisory remediations state that EVLink WallBox has reached end of life and no fix is planned, and recommend segmentation, firewalling HTTP access, log review, and password hygiene. The source also lists EVLink Pro AC as the replacement product offering.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.