CVE-2025-5743 Schneider Electric CVE debrief

Who should care

Organizations that operate Schneider Electric EVLink WallBox chargers, especially OT/ICS security teams, facility operators, and network administrators responsible for the device’s web management access.

Technical summary

The advisory identifies CWE-78, improper neutralization of special elements used in an OS command. The affected product is Schneider Electric EVLink WallBox, all versions. The supplied CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N, which scores 5.5 (Medium). The key security condition is that the attacker must be authenticated before modifying configuration parameters on the web server. Because the device is end-of-life, remediation is centered on reducing exposure of the HTTP interface, tightening credentials, reviewing logs, and replacing the product with the supported EVLink Pro AC where feasible.

Defensive priority

Medium; raise priority if the web management interface is reachable from untrusted or broadly shared networks.

Recommended defensive actions

• Restrict access to the EVLink WallBox web interface to a trusted management network only.
• Implement network segmentation and firewall rules to block unauthorized HTTP access.
• Review access logs periodically for suspicious configuration changes or login activity.
• Use strong, unique passwords and change them on a regular schedule.
• Treat the product as end-of-life and plan migration to Schneider Electric EVLink Pro AC.
• Validate that only authorized personnel can administer the device and remove stale accounts where possible.

Evidence notes

CISA CSAF advisory ICSA-25-175-04 and Schneider Electric’s security notice describe a CWE-78 OS command injection affecting EVLink WallBox all versions. The advisory states that an authenticated user modifying web-server configuration parameters could cause remote control of the charging station. The supplied CVSS vector is AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N (5.5, Medium). The product is listed as end-of-life, with mitigation guidance focused on segmentation, blocking HTTP access, log review, and password hygiene.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.