CVE-2021-34592 Bender Charge Controller: Command injection via Web interface
An authenticated attacker can execute arbitrary shell commands via the web interface of Bender Charge Controllers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-34592?
CVE-2021-34592 is a high-severity command injection vulnerability in Bender / ebee CC612, published on 27 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.
Weakness: CWE-77
Which versions are affected by CVE-2021-34592?
It affects 2 products.
Products include Bender Cc612 Firmware, Bender Icc15xx Firmware.
How do I fix CVE-2021-34592?
No fix has been published for CVE-2021-34592 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-34592 being exploited?
There is no known exploitation of CVE-2021-34592 in the wild and no public exploit code.
Other vulnerabilities in Bender / ebee CC612
- CVE-2021-34601 Bender Charge Controller: Hardcoded Credentials in Charge Controller
- CVE-2021-34602 Bender Charge Controller: Long URL could lead to webserver crash
- CVE-2021-34588 Bender Charge Controller: Unprotected data export
- CVE-2021-34591 Bender Charge Controller: Local privilege Escalation
- CVE-2021-34589 Bender Charge Controller: RFID leak
Sources
Also known as GHSA-p4mq-j63q-grfw.