Credential Disclosure via Insecure Storage on Charge Controller
Priority MEDIUM 40CWE-522Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-522.
Summary
An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed CC612 (Bender): 5.33.3CC613 (Bender): 5.33.3+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bender / ebee | CC612 | 5.30.2 to before 5.33.3 | 5.33.3 | Patch available | CNA |
| Bender / ebee | CC613 | 5.30.2 to before 5.33.3 | 5.33.3 | Patch available | CNA |
| Bender / ebee | ICC16xx | 5.30.2 to before 5.33.3 | 5.33.3 | Patch available | CNA |
| Bender / ebee | ICC13xx | 5.30.2 to before 5.33.3 | 5.33.3 | Patch available | CNA |
- CC612 VendorBender / ebee Affected 5.30.2 to before 5.33.3 Fixed in 5.33.3 Patch available CNA
- CC613 VendorBender / ebee Affected 5.30.2 to before 5.33.3 Fixed in 5.33.3 Patch available CNA
- ICC16xx VendorBender / ebee Affected 5.30.2 to before 5.33.3 Fixed in 5.33.3 Patch available CNA
- ICC13xx VendorBender / ebee Affected 5.30.2 to before 5.33.3 Fixed in 5.33.3 Patch available CNA
Remediation
- Fix · CNA CC612 (Bender) Fixed in 5.33.3
- Fix · CNA CC613 (Bender) Fixed in 5.33.3
- Fix · CNA ICC16xx (Bender) Fixed in 5.33.3
- Fix · CNA ICC13xx (Bender) Fixed in 5.33.3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-41682
- 2026-10-03 Alias added: GHSA-mxg6-f57q-5xh5
References
More Bender / ebee vulnerabilities
- TI-2021-13619 Bender Charge Controller: Hardcoded Credentials in Charge Controller CVSS 3.1CRITICAL 9.8
- TI-2021-13620 Bender Charge Controller: Long URL could lead to webserver crash CVSS 3.1HIGH 8.8
- TI-2021-13610 Bender Charge Controller: Command injection via Web interface CVSS 3.1HIGH 8.8
- TI-2019-14334 In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the… CVSS 3.1CRITICAL 9.1
- TI-2021-13606 Bender Charge Controller: Unprotected data export CVSS 3.1HIGH 8.6
- TI-2021-13607 Bender Charge Controller: RFID leak CVSS 3.1HIGH 7.5
Sources
- CVE-2025-41682 · CVE Program
- CVE-2025-41682 · NVD
- FIRST EPSS
- GHSA-mxg6-f57q-5xh5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences