CVE-2021-34587: Bender Charge Controller: Long URL could lead to webserver crash

Q: What can an unauthenticated attacker do?

An attacker can send a long URL over the network without authentication or user interaction and cause the webserver to crash. The provided CVSS vector indicates an availability impact only, with no stated confidentiality or integrity impact.

Q: Which systems should be prioritized for review?

Review deployments using Bender Cc612, Cc613, Icc15xx, or Icc16xx firmware, as well as IBM Rational Lifecycle Integration Adapter for Windchill, because these are listed as affected software. The data states that multiple versions are affected but does not identify specific fixed or vulnerable version ranges.

Q: How can exposure be reduced if updates cannot be applied immediately?

Limit network access to the affected webserver to trusted administrative networks where possible. This reduces the opportunity for an unauthenticated remote party to submit an oversized URL that triggers the crash.

Published Apr 27, 2022

Updated

In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a stack variable.

Affected Software

21 affected components

IBM Rational Lifecycle Integration Adapter for Windchill=1.0.0

Bender Cc612 Firmware>=5.11.0<5.11.2

Bender Cc612 Firmware>=5.12.0<5.12.5

Bender Cc612 Firmware>=5.13.0<5.13.2

Bender Cc612 Firmware>=5.20.0<5.20.2

Bender CC612

Bender Cc613 Firmware>=5.11.0<5.11.2

Bender Cc613 Firmware>=5.12.0<5.12.5

Bender Cc613 Firmware>=5.13.0<5.13.2

Bender Cc613 Firmware>=5.20.0<5.20.2

Bender Cc613

Bender Icc15xx Firmware>=5.11.0<5.11.2

Bender Icc15xx Firmware>=5.12.0<5.12.5

Bender Icc15xx Firmware>=5.13.0<5.13.2

Bender Icc15xx Firmware>=5.20.0<5.20.2

Bender Icc15xx

Bender Icc16xx Firmware>=5.11.0<5.11.2

Bender Icc16xx Firmware>=5.12.0<5.12.5

Bender Icc16xx Firmware>=5.13.0<5.13.2

Bender Icc16xx Firmware>=5.20.0<5.20.2

Bender Icc16xx

Event History

Apr 27, 2022

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What can an unauthenticated attacker do?

An attacker can send a long URL over the network without authentication or user interaction and cause the webserver to crash. The provided CVSS vector indicates an availability impact only, with no stated confidentiality or integrity impact.

Which systems should be prioritized for review?

Review deployments using Bender Cc612, Cc613, Icc15xx, or Icc16xx firmware, as well as IBM Rational Lifecycle Integration Adapter for Windchill, because these are listed as affected software. The data states that multiple versions are affected but does not identify specific fixed or vulnerable version ranges.

How can exposure be reduced if updates cannot be applied immediately?

Limit network access to the affected webserver to trusted administrative networks where possible. This reduces the opportunity for an unauthenticated remote party to submit an oversized URL that triggers the crash.

CVE-2021-34587: Bender Charge Controller: Long URL could lead to webserver crash

Affected Software

Event History

Frequently Asked Questions

What can an unauthenticated attacker do?

Which systems should be prioritized for review?

How can exposure be reduced if updates cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

What can an unauthenticated attacker do?

Which systems should be prioritized for review?

How can exposure be reduced if updates cannot be applied immediately?