CVE-2022-22808 in EcoStruxure EV Charging Expert
Summary
by MITRE • 02/10/2022
A CWE-942: Permissive Cross-domain Policy with Untrusted Domains vulnerability exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain attacks based on same-origin policy or cross-site request forgery protections bypass. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/29/2026
The CVE-2022-22808 vulnerability represents a critical security flaw in EcoStruxure EV Charging Expert software, specifically affecting versions prior to SP8 (Version 01) V4.0.0.13. This vulnerability maps directly to CWE-942, which describes permissive cross-domain policies that include untrusted domains, creating dangerous attack vectors for remote adversaries. The affected product line includes multiple hardware models identified by specific identifiers such as HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, and others, all sharing this fundamental security weakness that compromises the integrity of cross-domain communications.
The technical flaw stems from improper implementation of cross-domain security policies within the web-based interface of the EV charging management system. When the system processes cross-domain requests, it fails to properly validate or restrict domain access, allowing malicious actors to exploit the same-origin policy protections that are typically enforced by web browsers and security frameworks. This permissive policy configuration enables attackers to craft cross-site request forgery attacks that bypass normal security boundaries, effectively undermining the established security model that should protect the system from unauthorized access attempts.
The operational impact of this vulnerability extends beyond simple data exposure, as it creates opportunities for remote attackers to perform unauthorized actions within the charging system's administrative interface. Attackers could potentially manipulate charging sessions, modify system configurations, or extract sensitive operational data without proper authentication. The vulnerability particularly affects environments where the system interfaces with external domains or services, making it especially dangerous in networked charging station deployments where multiple systems communicate across different domains. This weakness essentially allows attackers to establish unauthorized communication channels that could lead to complete system compromise or unauthorized charging operations.
Mitigation strategies for CVE-2022-22808 should prioritize immediate software updates to SP8 (Version 01) V4.0.0.13 or later, which contain the necessary patches to address the permissive cross-domain policy implementation. Organizations should also implement network segmentation to limit access to the affected systems, enforce strict firewall rules for the web interface ports, and conduct thorough security assessments of all cross-domain communications. Additionally, administrators should review and tighten existing cross-domain policies, ensuring that only explicitly trusted domains are permitted to communicate with the system. This vulnerability aligns with ATT&CK technique T1190 for exploiting web applications and T1071.001 for application layer protocols, emphasizing the need for comprehensive defensive measures including web application firewalls and regular security monitoring. The remediation process should also include validating that all external communications are properly authenticated and that the system enforces strict cross-origin resource sharing policies to prevent similar vulnerabilities in the future.