Bender Charge Controller: Long URL could lead to webserver crash
CVE-2021-34602

8.8HIGH

Key Information:

Vendor

Bender / Ebee

Status
Cc612
Cc613
Icc15xx
Icc16xx
Vendor
CVE Published:
27 April 2022

What is CVE-2021-34602?

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.

Affected Version(s)

CC612 5.11.x < 5.11.2

CC612 5.12.x < 5.12.5

CC612 5.13.x < 5.13.2

References

https://cert.vde.com/en/advisories/VDE-2021-047
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bender thanks Qianxin StarV Security Lab, China. The issue was coordinated by CERT@VDE.
.