# Schneider Electric EVLink WallBox path traversal and command injection

Published: 2025-07-22 · Severity: routine · Sectors: transportation
Canonical: https://vorant.io/reports/ff2f8cd1-b526-5eee-b023-ef612e55a5f1/schneider-electric-evlink-wallbox-path-traversal-and-command-injection

> Multiple vulnerabilities in end-of-life EVLink WallBox charging stations allow authenticated attackers remote control; upgrade to EVLink Pro AC.

Schneider Electric EVLink WallBox charging stations contain four vulnerabilities affecting all versions: a path traversal flaw enabling arbitrary file writes (CVE-2025-5740, CVSS 8.6), a path traversal allowing file reads (CVE-2025-5741), cross-site scripting via configuration parameters (CVE-2025-5742), and OS command injection enabling remote control (CVE-2025-5743, CVSS 7.0). All four require authentication to the web server, with the most severe flaws (file writes and command injection) needing high-privilege access.

The product has reached end-of-life and Schneider Electric no longer provides patches. Exploitation has not been reported in the wild as of the advisory date. Defenders operating these charging stations should prioritize network segmentation, restrict web interface access via firewall rules, enforce strong authentication, and disable public IP accessibility. The vendor recommends immediate upgrade to EVLink Pro AC as the primary mitigation strategy.

Due to the authentication requirement and lack of active exploitation, severity is high rather than critical, but the combination of path traversal and command injection on critical-infrastructure charging equipment warrants urgent attention from operators in transportation systems.

## Mentioned in this report

- Vulnerabilities: CVE-2025-5740, CVE-2025-5741, CVE-2025-5742, CVE-2025-5743

## Detection guidance (public sample)

### Web Path Traversal Sequence in Request Returning Success

ATT&CK: T1190

Detects HTTP requests whose URI contains directory traversal sequences (plain, URL-encoded or double-encoded) and that return HTTP 200. This matches the arbitrary file read/write path traversal flaws in embedded device web interfaces such as EVLink WallBox. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Path Traversal Sequence in Request Returning Success
id: d91a666c-17b9-514c-8358-4f7182af6882
status: experimental
description: Detects HTTP requests with directory traversal sequences (plain, URL-encoded
  or double-encoded) in the URI that return HTTP 200. Matches exploitation of path
  traversal file read/write flaws in embedded device web management interfaces such
  as EVLink WallBox (CVE-2025-5740/5741). Generalises on the traversal pattern, not
  on a product-specific URL.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-04
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1083
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri-stem|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%2f
    - '%2e%2e%5c'
    - ..%5c
    - '%252e%252e'
  selection_traversal_query:
    cs-uri-query|contains:
    - ../
    - ..\
    - '%2e%2e%2f'
    - '%2e%2e/'
    - ..%2f
    - '%2e%2e%5c'
    - ..%5c
    - '%252e%252e'
  selection_status:
    sc-status: 200
  condition: 1 of selection_traversal* and selection_status
falsepositives:
- Web applications that legitimately pass relative paths in query parameters, for
  example file managers or documentation viewers
- Vulnerability scanners run by the security team against the device
level: medium
author: Vorant
```

### Shell Command Injection Pattern in Web Request Query

ATT&CK: T1190

Detects web requests whose query string contains shell metacharacters followed by common command-execution utilities, indicating OS command injection against device web interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shell Command Injection Pattern in Web Request Query
id: e1b7593e-06ec-5a2b-a47b-d89e7b2bfa89
status: experimental
description: Detects shell metacharacters (semicolon, pipe, backtick, command substitution)
  followed by common command utilities in the URI query of web requests. Matches OS
  command injection in embedded device management interfaces such as EVLink WallBox
  (CVE-2025-5743). Only the URI is inspected, so injection through POST bodies is
  not covered.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-04
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_sep_cmd:
    cs-uri-query|contains:
    - ;wget
    - ;curl
    - ';nc '
    - ;cat /etc/
    - ;id;
    - '|wget'
    - '|curl'
    - '|nc '
    - '|sh'
    - '%3bwget'
    - '%3bcurl'
    - '%3bnc%20'
    - '%3bcat%20/etc/'
    - '%7cwget'
    - '%7ccurl'
    - '%7csh'
  selection_subst:
    cs-uri-query|contains:
    - $(id)
    - $(wget
    - $(curl
    - '`id`'
    - '`wget'
    - '`curl'
    - '%24%28id%29'
    - '%24%28wget'
    - '%60id%60'
  condition: 1 of selection_*
falsepositives:
- Penetration tests and vulnerability scanners probing devices with injection payloads
- Web applications that accept shell-like text in search parameters, such as documentation
  or code search
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ff2f8cd1-b526-5eee-b023-ef612e55a5f1/schneider-electric-evlink-wallbox-path-traversal-and-command-injection.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup