CVE-2021-34588 Bender Charge Controller: Unprotected data export
Attackers can access sensitive backup data because the protection key is empty after a device reboot, exposing configuration details.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34588?
CVE-2021-34588 is a high-severity missing authorization vulnerability in Bender / ebee CC612, published on 27 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot .
Weakness: CWE-425
Which versions are affected by CVE-2021-34588?
It affects 2 products.
Products include Bender Cc612 Firmware, Bender Icc15xx Firmware.
How do I fix CVE-2021-34588?
No fix has been published for CVE-2021-34588 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-34588 being exploited?
There is no known exploitation of CVE-2021-34588 in the wild and no public exploit code.
Other vulnerabilities in Bender / ebee CC612
- CVE-2021-34601 Bender Charge Controller: Hardcoded Credentials in Charge Controller
- CVE-2021-34592 Bender Charge Controller: Command injection via Web interface
- CVE-2021-34602 Bender Charge Controller: Long URL could lead to webserver crash
- CVE-2021-34591 Bender Charge Controller: Local privilege Escalation
- CVE-2021-34589 Bender Charge Controller: RFID leak
Sources
Also known as GHSA-m4qj-mfxh-2v5c.