CVE-2021-34588
Assigner: CERTVDE
Published: 2022-04-27T00:00:00
State: PUBLISHED
affected: product: CC612
vendor: Bender / ebee
versions: lessThan: 5.11.2
status: affected
version: 5.11.x
versionType: custom
lessThan: 5.12.5
status: affected
version: 5.12.x
versionType: custom
lessThan: 5.13.2
status: affected
version: 5.13.x
versionType: custom
lessThan: 5.20.2
status: affected
version: 5.20.x
versionType: custom
product: CC613
vendor: Bender / ebee
versions: lessThan: 5.11.2
status: affected
version: 5.11.x
versionType: custom
lessThan: 5.12.5
status: affected
version: 5.12.x
versionType: custom
lessThan: 5.13.2
status: affected
version: 5.13.x
versionType: custom
lessThan: 5.20.2
status: affected
version: 5.20.x
versionType: custom
product: ICC15xx
vendor: Bender / ebee
versions: lessThan: 5.11.2
status: affected
version: 5.11.x
versionType: custom
lessThan: 5.12.5
status: affected
version: 5.12.x
versionType: custom
lessThan: 5.13.2
status: affected
version: 5.13.x
versionType: custom
lessThan: 5.20.2
status: affected
version: 5.20.x
versionType: custom
product: ICC16xx
vendor: Bender / ebee
versions: lessThan: 5.11.2
status: affected
version: 5.11.x
versionType: custom
lessThan: 5.12.5
status: affected
version: 5.12.x
versionType: custom
lessThan: 5.13.2
status: affected
version: 5.13.x
versionType: custom
lessThan: 5.20.2
status: affected
version: 5.20.x
versionType: custom
credits: value: Bender thanks the IT security researchers at OpenSource Security GmbH for their thorough and in-depth work. The issue was coordinated by CERT@VDE.
datePublic: 2022-04-27T00:00:00
descriptions: value: In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot .
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-425
description: CWE-425 Direct Request (Forced Browsing)
type: CWE
source: advisory: VDE-2021-047
defect: CERT@VDE#64088
discovery: EXTERNAL
title: Bender Charge Controller: Unprotected data export 
x_generator: engine: Vulnogram 0.0.9