Cross-site request forgery in EcoStruxure EV Charging Expert : V4.0.0.13)
Priority LOW 39CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
A CWE-352: Cross-Site Request Forgery (CSRF) exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain attacks based on same-origin policy or cross-site request forgery protections bypass. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)
Why it matters now
EPSS 0.00675 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) | EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) | — | No fix listed | CNA |
- EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) Vendor— Affected EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13) Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:hmibscea53d1edb_firmware:*:*:*:*:*:*:*:* | before 4.0.0.13 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmibscea53d1edb:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:hmibscea53d1eds_firmware:*:*:*:*:*:*:*:* | before 4.0.0.13 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmibscea53d1eds:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:hmibscea53d1edm_firmware:*:*:*:*:*:*:*:* | before 4.0.0.13 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmibscea53d1edm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:hmibscea53d1edl_firmware:*:*:*:*:*:*:*:* | before 4.0.0.13 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmibscea53d1edl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:hmibscea53d1ess_firmware:*:*:*:*:*:*:*:* | before 4.0.0.13 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmibscea53d1ess:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:o:schneider-electric:hmibscea53d1edb_firmware:*:*:*:*:*:*:*:* Versions before 4.0.0.13 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmibscea53d1edb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:hmibscea53d1eds_firmware:*:*:*:*:*:*:*:* Versions before 4.0.0.13 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmibscea53d1eds:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:hmibscea53d1edm_firmware:*:*:*:*:*:*:*:* Versions before 4.0.0.13 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmibscea53d1edm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:hmibscea53d1edl_firmware:*:*:*:*:*:*:*:* Versions before 4.0.0.13 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmibscea53d1edl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:hmibscea53d1ess_firmware:*:*:*:*:*:*:*:* Versions before 4.0.0.13 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmibscea53d1ess:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:hmibscea53d1esm_firmware:*:*:*:*:*:*:*:* | before 4.0.0.13 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmibscea53d1esm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:hmibscea53d1eml_firmware:*:*:*:*:*:*:*:* | before 4.0.0.13 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:hmibscea53d1eml:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:o:schneider-electric:hmibscea53d1esm_firmware:*:*:*:*:*:*:*:* Versions before 4.0.0.13 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmibscea53d1esm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:hmibscea53d1eml_firmware:*:*:*:*:*:*:*:* Versions before 4.0.0.13 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:hmibscea53d1eml:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22808
- 2026-10-03 Alias added: GHSA-p6hc-w7h4-q55x
More Schneider Electric Hmibscea53d1edb Firmware vulnerabilities
- TI-2022-07051 Clickjacking in EcoStruxure EV Charging Expert : V4.0.0.13) CVSS 3.1HIGH 7.4
Sources
- CVE-2022-22808 · CVE Program
- CVE-2022-22808 · NVD
- FIRST EPSS
- GHSA-p6hc-w7h4-q55x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences