Skip to content
OpenAdvisories
High · 8.8 CVE-2021-34592 EUVD-2021-21242GHSA-p4mq-j63q-grfw

Bender Charge Controller: Command injection via Web interface

Published Apr 27, 2022 · Updated Sep 16, 2024 · Assigned by CERTVDE

Vendor: Bender / ebee Product: CC612 Product: CC613 Product: ICC15xx Product: ICC16xx

Description

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.

Affected products

VendorProductAffectedFixed
Bender / ebee CC612 5.11.x – < 5.11.2, 5.12.x – < 5.12.5, 5.13.x – < 5.13.2, 5.20.x – < 5.20.2 5.11.2
Bender / ebee CC613 5.11.x – < 5.11.2, 5.12.x – < 5.12.5, 5.13.x – < 5.13.2, 5.20.x – < 5.20.2 5.11.2
Bender / ebee ICC15xx 5.11.x – < 5.11.2, 5.12.x – < 5.12.5, 5.13.x – < 5.13.2, 5.20.x – < 5.20.2 5.11.2
Bender / ebee ICC16xx 5.11.x – < 5.11.2, 5.12.x – < 5.12.5, 5.13.x – < 5.13.2, 5.20.x – < 5.20.2 5.11.2

References