Bender Charge Controller: Hardcoded Credentials in Charge Controller
Priority MEDIUM 44CWE-259Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-259.
Summary
In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI.
Why it matters now
EPSS 0.01084 65th percentileScored 2026-11-07
Fix Fixed CC612 (Bender / ebee): 5.11.2, 5.12.5, 5.13.2 +1CC613 (Bender / ebee): 5.11.2, 5.12.5, 5.13.2 +1+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bender / ebee | CC612 | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
| Bender / ebee | CC613 | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
| Bender / ebee | ICC15xx | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
| Bender / ebee | ICC16xx | 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 | 5.11.2, 5.12.5, 5.13.2, 5.20.2 | Patch available | CNA |
- CC612 VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
- CC613 VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
- ICC15xx VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
- ICC16xx VendorBender / ebee Affected 5.11.x to before 5.11.2; 5.12.x to before 5.12.5; 5.13.x to before 5.13.2; 5.20.x to before 5.20.2 Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bender:cc612_firmware:*:*:*:*:*:*:*:* | 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 | Vulnerable | Bender / ebee |
| cpe:2.3:h:bender:cc612:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bender / ebee |
| cpe:2.3:o:bender:icc15xx_firmware:*:*:*:*:*:*:*:* | 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 | Vulnerable | Bender / ebee |
| cpe:2.3:h:bender:cc613:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bender / ebee |
- cpe:2.3:o:bender:cc612_firmware:*:*:*:*:*:*:*:* Versions 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 Vulnerable ·Bender / ebee
- cpe:2.3:h:bender:cc612:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bender / ebee
- cpe:2.3:o:bender:icc15xx_firmware:*:*:*:*:*:*:*:* Versions 5.11.0 to before 5.11.2; 5.12.0 to before 5.12.5; 5.13.0 to before 5.13.2; 5.20.0 to before 5.20.2 Vulnerable ·Bender / ebee
- cpe:2.3:h:bender:cc613:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bender / ebee
Remediation
- Fix · CNA CC612 (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
- Fix · CNA CC613 (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
- Fix · CNA ICC15xx (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
- Fix · CNA ICC16xx (Bender / ebee) Fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Bender / ebee CC612, CC613 and 2 more products 5.11.2, 5.12.5 and 2 more versions
8 records Highest priority Priority MEDIUM 3 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2021-13620 Bender Charge Controller: Long URL could lead to webserver crashPriority MEDIUM 41
- TI-2021-13610 Bender Charge Controller: Command injection via Web interfacePriority MEDIUM 41
- TI-2021-13606 Bender Charge Controller: Unprotected data exportPriority LOW 39
Timeline
- 2026-10-02 Threatist record created from CVE-2021-34601
- 2026-10-03 Alias added: GHSA-mrf8-4j8f-g2hr
References
More Bender / ebee Cc612 Firmware vulnerabilities
- TI-2021-13620 Bender Charge Controller: Long URL could lead to webserver crash CVSS 3.1HIGH 8.8
- TI-2021-13610 Bender Charge Controller: Command injection via Web interface CVSS 3.1HIGH 8.8
- TI-2021-13606 Bender Charge Controller: Unprotected data export CVSS 3.1HIGH 8.6
- TI-2021-13607 Bender Charge Controller: RFID leak CVSS 3.1HIGH 7.5
- TI-2021-13609 Bender Charge Controller: Local privilege Escalation CVSS 3.1HIGH 7.8
- TI-2021-13605 Bender Charge Controller: Long URL could lead to webserver crash CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-34601 · CVE Program
- CVE-2021-34601 · NVD
- FIRST EPSS
- GHSA-mrf8-4j8f-g2hr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences