CVE-2021-34591 Bender Charge Controller: Local privilege Escalation
An authenticated attacker can gain root access on Bender ebee Charge Controllers by exploiting SUID applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34591?
CVE-2021-34591 is a high-severity vulnerability in Bender / ebee CC612, published on 27 Apr 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd.
Weakness: CWE-250
Which versions are affected by CVE-2021-34591?
It affects 2 products.
Products include Bender Cc612 Firmware, Bender Icc15xx Firmware.
How do I fix CVE-2021-34591?
No fix has been published for CVE-2021-34591 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-34591 being exploited?
There is no known exploitation of CVE-2021-34591 in the wild and no public exploit code.
Other vulnerabilities in Bender / ebee CC612
- CVE-2021-34601 Bender Charge Controller: Hardcoded Credentials in Charge Controller
- CVE-2021-34592 Bender Charge Controller: Command injection via Web interface
- CVE-2021-34602 Bender Charge Controller: Long URL could lead to webserver crash
- CVE-2021-34588 Bender Charge Controller: Unprotected data export
- CVE-2021-34589 Bender Charge Controller: RFID leak
Sources
Also known as GHSA-27j2-98fj-7r5w.