CVE-2021-34589: Bender Charge Controller: RFID leak

Q: Who can exploit this issue?

An unauthenticated attacker who can reach the affected charge controller's web interface can read the RFID associated with the last charge event. No privileges or user interaction are required.

Q: What information is exposed?

The web interface exposes the RFID of the last charge event. The provided data does not indicate exposure of other charge-event details or controller settings.

Q: Are systems affected by default?

The issue is reachable through the web interface without authentication, but the provided data does not state whether that interface is enabled or network-accessible in default deployments.

Q: How can I determine whether a controller is affected?

Identify whether the deployment uses Bender CC612, CC613, ICC15xx, ICC16xx, or ICC613 firmware, then assess whether its web interface is reachable without authentication. The provided data does not list affected or fixed firmware versions.

Published Apr 27, 2022

Updated

In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface.

Affected Software

20 affected components

Bender Cc612 Firmware>=5.11.0<5.11.2

Bender Cc612 Firmware>=5.12.0<5.12.5

Bender Cc612 Firmware>=5.13.0<5.13.2

Bender Cc612 Firmware>=5.20.0<5.20.2

Bender CC612

Bender Cc613 Firmware>=5.11.0<5.11.2

Bender Cc613 Firmware>=5.13.0<5.13.2

Bender Cc613 Firmware>=5.20.0<5.20.2

Bender Icc613 Firmware>=5.12.0<5.12.5

Bender Cc613

Bender Icc15xx Firmware>=5.11.0<5.11.2

Bender Icc15xx Firmware>=5.12.0<5.12.5

Bender Icc15xx Firmware>=5.13.0<5.13.2

Bender Icc15xx Firmware>=5.20.0<5.20.2

Bender Icc15xx

Bender Icc16xx Firmware>=5.11.0<5.11.2

Bender Icc16xx Firmware>=5.12.0<5.12.5

Bender Icc16xx Firmware>=5.13.0<5.13.2

Bender Icc16xx Firmware>=5.20.0<5.20.2

Bender Icc16xx

Event History

Apr 27, 2022

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker who can reach the affected charge controller's web interface can read the RFID associated with the last charge event. No privileges or user interaction are required.

What information is exposed?

The web interface exposes the RFID of the last charge event. The provided data does not indicate exposure of other charge-event details or controller settings.

Are systems affected by default?

The issue is reachable through the web interface without authentication, but the provided data does not state whether that interface is enabled or network-accessible in default deployments.

How can I determine whether a controller is affected?

Identify whether the deployment uses Bender CC612, CC613, ICC15xx, ICC16xx, or ICC613 firmware, then assess whether its web interface is reachable without authentication. The provided data does not list affected or fixed firmware versions.

CVE-2021-34589: Bender Charge Controller: RFID leak

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information is exposed?

Are systems affected by default?

How can I determine whether a controller is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information is exposed?

Are systems affected by default?

How can I determine whether a controller is affected?