CVE-2021-34602: In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands…

PriorityP356high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.33%

67.6th percentile

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.

Affected

24 ranges

Vendor	Product	Version range	Fixed in
bender	cc612_firmware	>= 5.11.0 < 5.11.2	5.11.2
bender	cc612_firmware	>= 5.12.0 < 5.12.5	5.12.5
bender	cc612_firmware	>= 5.13.0 < 5.13.2	5.13.2
bender	cc612_firmware	>= 5.20.0 < 5.20.2	5.20.2
bender	ebee_cc612	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_cc612	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_cc612	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_cc612	>= 5.20.x < 5.20.2	5.20.2
bender	ebee_cc613	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_cc613	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_cc613	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_cc613	>= 5.20.x < 5.20.2	5.20.2
bender	ebee_icc15xx	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_icc15xx	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_icc15xx	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_icc15xx	>= 5.20.x < 5.20.2	5.20.2
bender	ebee_icc16xx	>= 5.11.x < 5.11.2	5.11.2
bender	ebee_icc16xx	>= 5.12.x < 5.12.5	5.12.5
bender	ebee_icc16xx	>= 5.13.x < 5.13.2	5.13.2
bender	ebee_icc16xx	>= 5.20.x < 5.20.2	5.20.2
bender	icc15xx_firmware	>= 5.11.0 < 5.11.2	5.11.2
bender	icc15xx_firmware	>= 5.12.0 < 5.12.5	5.12.5
bender	icc15xx_firmware	>= 5.13.0 < 5.13.2	5.13.2
bender	icc15xx_firmware	>= 5.20.0 < 5.20.2	5.20.2

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.