Bender Charge Controller: Command injection via Web interface
Priority MEDIUM 41CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.
Summary
In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.
Why it matters now
EPSS 0.01391 72nd percentileScored 2026-11-07
Fix Fixed CC612 (Bender / ebee): 5.11.2, 5.12.5, 5.13.2 +1CC613 (Bender / ebee): 5.11.2, 5.12.5, 5.13.2 +1+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bender / ebee | CC612 | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
| Bender / ebee | CC613 | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
| Bender / ebee | ICC15xx | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
| Bender / ebee | ICC16xx | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
- CC612 VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
- CC613 VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
- ICC15xx VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
- ICC16xx VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bender:cc612_firmware:*:*:*:*:*:*:*:* | 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 | Vulnerable | Bender / ebee |
| cpe:2.3:h:bender:cc612:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bender / ebee |
| cpe:2.3:o:bender:icc15xx_firmware:*:*:*:*:*:*:*:* | 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 | Vulnerable | Bender / ebee |
| cpe:2.3:h:bender:cc613:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bender / ebee |
- cpe:2.3:o:bender:cc612_firmware:*:*:*:*:*:*:*:* Versions 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 Vulnerable ·Bender / ebee
- cpe:2.3:h:bender:cc612:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bender / ebee
- cpe:2.3:o:bender:icc15xx_firmware:*:*:*:*:*:*:*:* Versions 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 Vulnerable ·Bender / ebee
- cpe:2.3:h:bender:cc613:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bender / ebee
Remediation
- Fix · CNA CC612 (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
- Fix · CNA CC613 (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
- Fix · CNA ICC15xx (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
- Fix · CNA ICC16xx (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Bender / ebee CC612, CC613 and 2 more products 5.11.2, 5.12.5 and 2 more versions
8 records Highest priority Priority MEDIUM 3 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2021-13619 Bender Charge Controller: Hardcoded Credentials in Charge ControllerPriority MEDIUM 44
- TI-2021-13620 Bender Charge Controller: Long URL could lead to webserver crashPriority MEDIUM 41
- TI-2021-13606 Bender Charge Controller: Unprotected data exportPriority LOW 39
Timeline
- 2026-10-02 Threatist record created from CVE-2021-34592
- 2026-10-03 Alias added: GHSA-p4mq-j63q-grfw
References
More Bender / ebee Cc612 Firmware vulnerabilities
- TI-2021-13619 Bender Charge Controller: Hardcoded Credentials in Charge Controller CVSS 3.1CRITICAL 9.8
- TI-2021-13620 Bender Charge Controller: Long URL could lead to webserver crash CVSS 3.1HIGH 8.8
- TI-2021-13606 Bender Charge Controller: Unprotected data export CVSS 3.1HIGH 8.6
- TI-2021-13607 Bender Charge Controller: RFID leak CVSS 3.1HIGH 7.5
- TI-2021-13609 Bender Charge Controller: Local privilege Escalation CVSS 3.1HIGH 7.8
- TI-2021-13605 Bender Charge Controller: Long URL could lead to webserver crash CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-34592 · CVE Program
- CVE-2021-34592 · NVD
- FIRST EPSS
- GHSA-p4mq-j63q-grfw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences