CVE-2021-34602highCWE-78

CVE-2021-34602: high-severity vulnerability in Bender / ebee CC612

Bender Charge Controller: Long URL could lead to webserver crash

Published · Updated

Follow this CVE+ Monitor CC612+ Monitor CC613

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 1.4%
In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Bender / ebee · CC612Bender / ebee · CC613Bender / ebee · ICC15xxBender / ebee · ICC16xx
Related CVEs — Bender / ebee CC612

In the same product, most dangerous first.

CVE-2021-34592HIGHBender Charge Controller: Command injection via Web interfaceEPSS 1.4%CVE-2021-34601CRITICALBender Charge Controller: Hardcoded Credentials in Charge ControllerEPSS 1.1%CVE-2021-34589HIGHBender Charge Controller: RFID leakEPSS 1.0%CVE-2021-34587MEDIUMBender Charge Controller: Long URL could lead to webserver crashEPSS 0.9%CVE-2021-34588HIGHBender Charge Controller: Unprotected data exportEPSS 0.9%CVE-2021-34590MEDIUMBender Charge Controller: Cross-site ScriptingEPSS 0.5%