Back to Database
Status published
Medium
CVE-2021-34590
Bender Charge Controller: Cross-site Scripting
Vulnerability Description
In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-34590
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Bender thanks the IT security researchers at OpenSource Security GmbH for their thorough and in-depth work. The issue was coordinated by CERT@VDE.
More from Bender / ebee
View All →CVE-2021-34602
Bender Charge Controller: Long URL could lead to webserver crash
High
8.8
CVE-2021-34601
Bender Charge Controller: Hardcoded Credentials in Charge Controller
Critical
9.8
CVE-2021-34592
Bender Charge Controller: Command injection via Web interface
High
8.8
CVE-2021-34591
Bender Charge Controller: Local privilege Escalation
High
7.8
CVE-2021-34589
Bender Charge Controller: RFID leak
High
7.5
Affected Vendor
Bender / ebee
View all reports →Affected Software
CC612, CC613, ICC15xx, ICC16xx
Vulnerable Versions:
5.11.x, 5.12.x, 5.13.x, 5.20.x
Timeline
Official Publish:
April 27th, 2022
Last Modified:
September 16th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N