CVE-2021-34592

published 2022-04-27

CVE-2021-34592: In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands…

Priority P3 55 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
bender	cc612_firmware	>= 5.11.0 < 5.11.2	5.11.2
bender	cc612_firmware	>= 5.12.0 < 5.12.5	5.12.5
bender	cc612_firmware	>= 5.13.0 < 5.13.2	5.13.2
bender	cc612_firmware	>= 5.20.0 < 5.20.2	5.20.2
bender	ebee_cc612	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_cc612	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_cc612	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_cc612	>= 5.20.x < 5.20.2	5.20.2
bender	ebee_cc613	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_cc613	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_cc613	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_cc613	>= 5.20.x < 5.20.2	5.20.2
bender	ebee_icc15xx	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_icc15xx	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_icc15xx	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_icc15xx	>= 5.20.x < 5.20.2	5.20.2
bender	ebee_icc16xx	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_icc16xx	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_icc16xx	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_icc16xx	>= 5.20.x < 5.20.2	5.20.2
bender	icc15xx_firmware	>= 5.11.0 < 5.11.2	5.11.2
bender	icc15xx_firmware	>= 5.12.0 < 5.12.5	5.12.5
bender	icc15xx_firmware	>= 5.13.0 < 5.13.2	5.13.2
bender	icc15xx_firmware	>= 5.20.0 < 5.20.2	5.20.2

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77