Back to Database
Status published
High
CVE-2021-34602
Bender Charge Controller: Long URL could lead to webserver crash
Vulnerability Description
In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-34602
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Bender thanks Qianxin StarV Security Lab, China. The issue was coordinated by CERT@VDE.
More from Bender / ebee
View All →CVE-2021-34601
Bender Charge Controller: Hardcoded Credentials in Charge Controller
Critical
9.8
CVE-2021-34592
Bender Charge Controller: Command injection via Web interface
High
8.8
CVE-2021-34591
Bender Charge Controller: Local privilege Escalation
High
7.8
CVE-2021-34590
Bender Charge Controller: Cross-site Scripting
Medium
5.4
CVE-2021-34589
Bender Charge Controller: RFID leak
High
7.5
Affected Vendor
Bender / ebee
View all reports →Affected Software
CC612, CC613, ICC15xx, ICC16xx
Vulnerable Versions:
5.11.x, 5.12.x, 5.13.x, 5.20.x
Timeline
Official Publish:
April 27th, 2022
Last Modified:
September 17th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H