CVE-2021-34592
Assigner: CERTVDE
Published: 2022-04-27T00:00:00
State: PUBLISHED
affected: product: CC612
vendor: Bender / ebee
versions: lessThan: 5.11.2
status: affected
version: 5.11.x
versionType: custom
lessThan: 5.12.5
status: affected
version: 5.12.x
versionType: custom
lessThan: 5.13.2
status: affected
version: 5.13.x
versionType: custom
lessThan: 5.20.2
status: affected
version: 5.20.x
versionType: custom
product: CC613
vendor: Bender / ebee
versions: lessThan: 5.11.2
status: affected
version: 5.11.x
versionType: custom
lessThan: 5.12.5
status: affected
version: 5.12.x
versionType: custom
lessThan: 5.13.2
status: affected
version: 5.13.x
versionType: custom
lessThan: 5.20.2
status: affected
version: 5.20.x
versionType: custom
product: ICC15xx
vendor: Bender / ebee
versions: lessThan: 5.11.2
status: affected
version: 5.11.x
versionType: custom
lessThan: 5.12.5
status: affected
version: 5.12.x
versionType: custom
lessThan: 5.13.2
status: affected
version: 5.13.x
versionType: custom
lessThan: 5.20.2
status: affected
version: 5.20.x
versionType: custom
product: ICC16xx
vendor: Bender / ebee
versions: lessThan: 5.11.2
status: affected
version: 5.11.x
versionType: custom
lessThan: 5.12.5
status: affected
version: 5.12.x
versionType: custom
lessThan: 5.13.2
status: affected
version: 5.13.x
versionType: custom
lessThan: 5.20.2
status: affected
version: 5.20.x
versionType: custom
credits: value: Bender thanks the IT security researchers at OpenSource Security GmbH for their thorough and in-depth work. The issue was coordinated by CERT@VDE.
datePublic: 2022-04-27T00:00:00
descriptions: value: In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
type: CWE
source: advisory: VDE-2021-047
defect: CERT@VDE#64088
discovery: EXTERNAL
title: Bender Charge Controller: Command injection via Web interface
x_generator: engine: Vulnogram 0.0.9