CVE-2021-34590: In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration…

PriorityP424medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.42%

33.7th percentile

In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
bender	cc612_firmware	>= 5.11.0 < 5.11.2	5.11.2
bender	cc612_firmware	>= 5.12.0 < 5.12.5	5.12.5
bender	cc612_firmware	>= 5.13.0 < 5.13.2	5.13.2
bender	cc612_firmware	>= 5.20.0 < 5.20.2	5.20.2
bender	ebee_cc612	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_cc612	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_cc612	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_cc612	>= 5.20.x < 5.20.2	5.20.2
bender	ebee_cc613	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_cc613	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_cc613	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_cc613	>= 5.20.x < 5.20.2	5.20.2
bender	ebee_icc15xx	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_icc15xx	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_icc15xx	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_icc15xx	>= 5.20.x < 5.20.2	5.20.2
bender	ebee_icc16xx	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_icc16xx	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_icc16xx	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_icc16xx	>= 5.20.x < 5.20.2	5.20.2
bender	icc15xx_firmware	>= 5.11.0 < 5.11.2	5.11.2
bender	icc15xx_firmware	>= 5.12.0 < 5.12.5	5.12.5
bender	icc15xx_firmware	>= 5.13.0 < 5.13.2	5.13.2
bender	icc15xx_firmware	>= 5.20.0 < 5.20.2	5.20.2

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.