CVE-2021-34592: Bender Charge Controller: Command injection via Web interface

Q: Who can exploit this issue?

An attacker must be authenticated to the charge controller's web interface. The CVSS vector indicates the attack can be performed over the network and does not require user interaction.

Q: What impact could successful exploitation have?

The attacker could enter shell commands through affected web-interface input fields. The reported CVSS metrics indicate potential high impact to confidentiality, integrity, and availability.

Q: Which products are identified as affected?

The affected software listed is Bender Cc612 Firmware and Bender Icc15xx Firmware. The provided data states that multiple versions are affected but does not identify specific version ranges.

Published Apr 27, 2022

Updated

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.

Affected Software

10 affected components

Bender Cc612 Firmware>=5.11.0<5.11.2

Bender Cc612 Firmware>=5.12.0<5.12.5

Bender Cc612 Firmware>=5.13.0<5.13.2

Bender Cc612 Firmware>=5.20.0<5.20.2

Bender CC612

Bender Icc15xx Firmware>=5.11.0<5.11.2

Bender Icc15xx Firmware>=5.12.0<5.12.5

Bender Icc15xx Firmware>=5.13.0<5.13.2

Bender Icc15xx Firmware>=5.20.0<5.20.2

Bender Cc613

Event History

Apr 27, 2022

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to the charge controller's web interface. The CVSS vector indicates the attack can be performed over the network and does not require user interaction.

What impact could successful exploitation have?

The attacker could enter shell commands through affected web-interface input fields. The reported CVSS metrics indicate potential high impact to confidentiality, integrity, and availability.

Which products are identified as affected?

The affected software listed is Bender Cc612 Firmware and Bender Icc15xx Firmware. The provided data states that multiple versions are affected but does not identify specific version ranges.

CVE-2021-34592: Bender Charge Controller: Command injection via Web interface

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact could successful exploitation have?

Which products are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact could successful exploitation have?

Which products are identified as affected?