CVE-2025-5743 Schneider Electric CVE debrief

Who should care

Organizations that operate Schneider Electric EVLink WallBox chargers, especially OT/ICS security teams, facility operators, and network administrators responsible for the device’s web management access.

Technical summary

The advisory identifies CWE-78, improper neutralization of special elements used in an OS command. The affected product is Schneider Electric EVLink WallBox, all versions. The supplied CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N, which scores 5.5 (Medium). The key security condition is that the attacker must be authenticated before modifying configuration parameters on the web server. Because the device is end-of-life, remediation is centered on reducing exposure of the HTTP interface, tightening credentials, reviewing logs, and replacing the product with the supported EVLink Pro AC where feasible.

Defensive priority

Medium; raise priority if the web management interface is reachable from untrusted or broadly shared networks.

Recommended defensive actions

• Restrict access to the EVLink WallBox web interface to a trusted management network only.
• Implement network segmentation and firewall rules to block unauthorized HTTP access.
• Review access logs periodically for suspicious configuration changes or login activity.
• Use strong, unique passwords and change them on a regular schedule.
• Treat the product as end-of-life and plan migration to Schneider Electric EVLink Pro AC.
• Validate that only authorized personnel can administer the device and remove stale accounts where possible.

Evidence notes

CISA CSAF advisory ICSA-25-175-04 and Schneider Electric’s security notice describe a CWE-78 OS command injection affecting EVLink WallBox all versions. The advisory states that an authenticated user modifying web-server configuration parameters could cause remote control of the charging station. The supplied CVSS vector is AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N (5.5, Medium). The product is listed as end-of-life, with mitigation guidance focused on segmentation, blocking HTTP access, log review, and password hygiene.

Official resources