Bender Charge Controller: Cross-site Scripting
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed.
Why it matters now
EPSS 0.00451 39th percentileScored 2026-11-07
Fix Fixed CC612 (Bender / ebee): 5.11.2, 5.12.5, 5.13.2 +1CC613 (Bender / ebee): 5.11.2, 5.12.5, 5.13.2 +1+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bender / ebee | CC612 | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
| Bender / ebee | CC613 | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
| Bender / ebee | ICC15xx | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
| Bender / ebee | ICC16xx | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
- CC612 VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
- CC613 VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
- ICC15xx VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
- ICC16xx VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bender:cc612_firmware:*:*:*:*:*:*:*:* | 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 | Vulnerable | Bender / ebee |
| cpe:2.3:h:bender:cc612:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bender / ebee |
| cpe:2.3:o:bender:icc15xx_firmware:*:*:*:*:*:*:*:* | 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 | Vulnerable | Bender / ebee |
| cpe:2.3:h:bender:cc613:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bender / ebee |
- cpe:2.3:o:bender:cc612_firmware:*:*:*:*:*:*:*:* Versions 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 Vulnerable ·Bender / ebee
- cpe:2.3:h:bender:cc612:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bender / ebee
- cpe:2.3:o:bender:icc15xx_firmware:*:*:*:*:*:*:*:* Versions 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 Vulnerable ·Bender / ebee
- cpe:2.3:h:bender:cc613:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bender / ebee
Remediation
- Fix · CNA CC612 (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
- Fix · CNA CC613 (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
- Fix · CNA ICC15xx (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
- Fix · CNA ICC16xx (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Bender / ebee CC612, CC613 and 2 more products 5.11.2, 5.12.5 and 2 more versions
8 records Highest priority Priority MEDIUM 3 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2021-13619 Bender Charge Controller: Hardcoded Credentials in Charge ControllerPriority MEDIUM 44
- TI-2021-13620 Bender Charge Controller: Long URL could lead to webserver crashPriority MEDIUM 41
- TI-2021-13610 Bender Charge Controller: Command injection via Web interfacePriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2021-34590
- 2026-10-03 Alias added: GHSA-93jw-9wg6-48pf
References
More Bender / ebee Cc612 Firmware vulnerabilities
- TI-2021-13619 Bender Charge Controller: Hardcoded Credentials in Charge Controller CVSS 3.1CRITICAL 9.8
- TI-2021-13620 Bender Charge Controller: Long URL could lead to webserver crash CVSS 3.1HIGH 8.8
- TI-2021-13610 Bender Charge Controller: Command injection via Web interface CVSS 3.1HIGH 8.8
- TI-2021-13606 Bender Charge Controller: Unprotected data export CVSS 3.1HIGH 8.6
- TI-2021-13607 Bender Charge Controller: RFID leak CVSS 3.1HIGH 7.5
- TI-2021-13609 Bender Charge Controller: Local privilege Escalation CVSS 3.1HIGH 7.8
Sources
- CVE-2021-34590 · CVE Program
- CVE-2021-34590 · NVD
- FIRST EPSS
- GHSA-93jw-9wg6-48pf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences