Schneider Electric EVLink WallBox path traversal and command injection
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple vulnerabilities in end-of-life EVLink WallBox charging stations allow authenticated attackers remote control; upgrade to EVLink Pro AC.
Schneider Electric EVLink WallBox charging stations contain four vulnerabilities affecting all versions: a path traversal flaw enabling arbitrary file writes (CVE-2025-5740, CVSS 8.6), a path traversal allowing file reads (CVE-2025-5741), cross-site scripting via configuration parameters (CVE-2025-5742), and OS command injection enabling remote control (CVE-2025-5743, CVSS 7.0). All four require authentication to the web server, with the most severe flaws (file writes and command injection) needing high-privilege access.
The product has reached end-of-life and Schneider Electric no longer provides patches. Exploitation has not been reported in the wild as of the advisory date. Defenders operating these charging stations should prioritize network segmentation, restrict web interface access via firewall rules, enforce strong authentication, and disable public IP accessibility. The vendor recommends immediate upgrade to EVLink Pro AC as the primary mitigation strategy.
Due to the authentication requirement and lack of active exploitation, severity is high rather than critical, but the combination of path traversal and command injection on critical-infrastructure charging equipment warrants urgent attention from operators in transportation systems.
Mentioned in this report
Detection guidance
Web Path Traversal Sequence in Request Returning Success
Detects HTTP requests whose URI contains directory traversal sequences (plain, URL-encoded or double-encoded) and that return HTTP 200. This matches the arbitrary file read/write path traversal flaws in embedded device web interfaces such as EVLink WallBox. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Path Traversal Sequence in Request Returning Success
id: d91a666c-17b9-514c-8358-4f7182af6882
status: experimental
description: Detects HTTP requests with directory traversal sequences (plain, URL-encoded
or double-encoded) in the URI that return HTTP 200. Matches exploitation of path
traversal file read/write flaws in embedded device web management interfaces such
as EVLink WallBox (CVE-2025-5740/5741). Generalises on the traversal pattern, not
on a product-specific URL.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-04
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1083
logsource:
category: webserver
detection:
selection_traversal:
cs-uri-stem|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%2e%2e%5c'
- ..%5c
- '%252e%252e'
selection_traversal_query:
cs-uri-query|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%2e%2e%5c'
- ..%5c
- '%252e%252e'
selection_status:
sc-status: 200
condition: 1 of selection_traversal* and selection_status
falsepositives:
- Web applications that legitimately pass relative paths in query parameters, for
example file managers or documentation viewers
- Vulnerability scanners run by the security team against the device
level: medium
author: Vorant
Shell Command Injection Pattern in Web Request Query
Detects web requests whose query string contains shell metacharacters followed by common command-execution utilities, indicating OS command injection against device web interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Command Injection Pattern in Web Request Query
id: e1b7593e-06ec-5a2b-a47b-d89e7b2bfa89
status: experimental
description: Detects shell metacharacters (semicolon, pipe, backtick, command substitution)
followed by common command utilities in the URI query of web requests. Matches OS
command injection in embedded device management interfaces such as EVLink WallBox
(CVE-2025-5743). Only the URI is inspected, so injection through POST bodies is
not covered.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-04
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_sep_cmd:
cs-uri-query|contains:
- ;wget
- ;curl
- ';nc '
- ;cat /etc/
- ;id;
- '|wget'
- '|curl'
- '|nc '
- '|sh'
- '%3bwget'
- '%3bcurl'
- '%3bnc%20'
- '%3bcat%20/etc/'
- '%7cwget'
- '%7ccurl'
- '%7csh'
selection_subst:
cs-uri-query|contains:
- $(id)
- $(wget
- $(curl
- '`id`'
- '`wget'
- '`curl'
- '%24%28id%29'
- '%24%28wget'
- '%60id%60'
condition: 1 of selection_*
falsepositives:
- Penetration tests and vulnerability scanners probing devices with injection payloads
- Web applications that accept shell-like text in search parameters, such as documentation
or code search
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-04
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs