CVE-2021-34591: Bender Charge Controller: Local privilege Escalation

Q: Who can exploit this issue?

An attacker must already be authenticated on an affected Bender/ebee Charge Controller. The CVSS vector indicates local access and low privileges are required; no user interaction is needed.

Q: What level of access could exploitation provide?

Successful exploitation could allow the authenticated local attacker to obtain root access, affecting confidentiality, integrity, and availability.

Q: Which components are involved in the privilege escalation path?

The issue is associated with the setuid applications socat, ip, udhcpc, and ifplugd on affected devices.

Published Apr 27, 2022

Updated

In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd.

Affected Software

10 affected components

Bender Cc612 Firmware>=5.11.0<5.11.2

Bender Cc612 Firmware>=5.12.0<5.12.5

Bender Cc612 Firmware>=5.13.0<5.13.2

Bender Cc612 Firmware>=5.20.0<5.20.2

Bender CC612

Bender Icc15xx Firmware>=5.11.0<5.11.2

Bender Icc15xx Firmware>=5.12.0<5.12.5

Bender Icc15xx Firmware>=5.13.0<5.13.2

Bender Icc15xx Firmware>=5.20.0<5.20.2

Bender Cc613

Event History

Apr 27, 2022

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must already be authenticated on an affected Bender/ebee Charge Controller. The CVSS vector indicates local access and low privileges are required; no user interaction is needed.

What level of access could exploitation provide?

Successful exploitation could allow the authenticated local attacker to obtain root access, affecting confidentiality, integrity, and availability.

Which components are involved in the privilege escalation path?

The issue is associated with the setuid applications socat, ip, udhcpc, and ifplugd on affected devices.

CVE-2021-34591: Bender Charge Controller: Local privilege Escalation

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of access could exploitation provide?

Which components are involved in the privilege escalation path?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of access could exploitation provide?

Which components are involved in the privilege escalation path?