Read the docs
TI-2021-13607 Aliases CVE-2021-34589GHSA-c36w-9wvv-9rh6

Bender Charge Controller: RFID leak

Priority LOW 35CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface.

Why it matters now

EPSS 0.0099 62nd percentileScored 2026-11-07
Fix Fixed CC612 (Bender / ebee): 5.11.2, 5.12.5, 5.13.2 +1CC613 (Bender / ebee): 5.11.2, 5.12.5, 5.13.2 +1+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Bender / ebeeCC6125.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.25.11.2, 5.12.5, 5.13.2, 5.20.2Patch availableCNA
Bender / ebeeCC6135.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.25.11.2, 5.12.5, 5.13.2, 5.20.2Patch availableCNA
Bender / ebeeICC15xx5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.25.11.2, 5.12.5, 5.13.2, 5.20.2Patch availableCNA
Bender / ebeeICC16xx5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.25.11.2, 5.12.5, 5.13.2, 5.20.2Patch availableCNA
  • CC612 VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
  • CC613 VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
  • ICC15xx VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
  • ICC16xx VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:o:bender:cc612_firmware:*:*:*:*:*:*:*:*5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2VulnerableBender / ebee
cpe:2.3:h:bender:cc612:-:*:*:*:*:*:*:*not specified by NVDRunning onBender / ebee
cpe:2.3:o:bender:cc613_firmware:*:*:*:*:*:*:*:*5.11.0 to before 5.11.2; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2VulnerableBender / ebee
cpe:2.3:o:bender:icc613_firmware:*:*:*:*:*:*:*:*5.12.0 to before 5.12.5VulnerableBender / ebee
cpe:2.3:h:bender:cc613:-:*:*:*:*:*:*:*not specified by NVDRunning onBender / ebee
cpe:2.3:o:bender:icc15xx_firmware:*:*:*:*:*:*:*:*5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2VulnerableBender / ebee
cpe:2.3:h:bender:icc15xx:-:*:*:*:*:*:*:*not specified by NVDRunning onBender / ebee
cpe:2.3:o:bender:icc16xx_firmware:*:*:*:*:*:*:*:*5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2VulnerableBender / ebee
cpe:2.3:h:bender:icc16xx:-:*:*:*:*:*:*:*not specified by NVDRunning onBender / ebee
  • cpe:2.3:o:bender:cc612_firmware:*:*:*:*:*:*:*:* Versions 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 Vulnerable ·Bender / ebee
  • cpe:2.3:h:bender:cc612:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bender / ebee
  • cpe:2.3:o:bender:cc613_firmware:*:*:*:*:*:*:*:* Versions 5.11.0 to before 5.11.2; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 Vulnerable ·Bender / ebee
  • cpe:2.3:o:bender:icc613_firmware:*:*:*:*:*:*:*:* Versions 5.12.0 to before 5.12.5 Vulnerable ·Bender / ebee
  • cpe:2.3:h:bender:cc613:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bender / ebee
  • cpe:2.3:o:bender:icc15xx_firmware:*:*:*:*:*:*:*:* Versions 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 Vulnerable ·Bender / ebee
  • cpe:2.3:h:bender:icc15xx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bender / ebee
  • cpe:2.3:o:bender:icc16xx_firmware:*:*:*:*:*:*:*:* Versions 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 Vulnerable ·Bender / ebee
  • cpe:2.3:h:bender:icc16xx:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bender / ebee

Remediation

  • Fix · CNA CC612 (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
  • Fix · CNA CC613 (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
  • Fix · CNA ICC15xx (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
  • Fix · CNA ICC16xx (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Bender / ebee CC612, CC613 and 2 more products 5.11.2, 5.12.5 and 2 more versions

    8 records Highest priority Priority MEDIUM 3 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2021-13619 Bender Charge Controller: Hardcoded Credentials in Charge ControllerPriority MEDIUM 44
    • TI-2021-13620 Bender Charge Controller: Long URL could lead to webserver crashPriority MEDIUM 41
    • TI-2021-13610 Bender Charge Controller: Command injection via Web interfacePriority MEDIUM 41
    Show all 8 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-34589
  2. 2026-10-03 Alias added: GHSA-c36w-9wvv-9rh6

References

Advisory 1

  • TI-2021-13619 Bender Charge Controller: Hardcoded Credentials in Charge Controller CVSS 3.1CRITICAL 9.8
  • TI-2021-13620 Bender Charge Controller: Long URL could lead to webserver crash CVSS 3.1HIGH 8.8
  • TI-2021-13610 Bender Charge Controller: Command injection via Web interface CVSS 3.1HIGH 8.8
  • TI-2021-13606 Bender Charge Controller: Unprotected data export CVSS 3.1HIGH 8.6
  • TI-2021-13609 Bender Charge Controller: Local privilege Escalation CVSS 3.1HIGH 7.8
  • TI-2021-13605 Bender Charge Controller: Long URL could lead to webserver crash CVSS 3.1MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences