by Kastro
Paper/Archive/CVE-2021-34601

CVE-2021-34601

Bender / ebee CC612 — Bender Charge Controller: Hardcoded Credentials in Charge Controller

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.2.652 × 2013.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI.

Affected

ProductAffectedFixed inSource
CC6125.11.x – < 5.11.25.11.2CNA
CC6125.12.x – < 5.12.55.12.5CNA
CC6125.13.x – < 5.13.25.13.2CNA
CC6125.20.x – < 5.20.25.20.2CNA
CC6135.11.x – < 5.11.25.11.2CNA
CC6135.12.x – < 5.12.55.12.5CNA
CC6135.13.x – < 5.13.25.13.2CNA
CC6135.20.x – < 5.20.25.20.2CNA
ICC15xx5.11.x – < 5.11.25.11.2CNA
ICC15xx5.12.x – < 5.12.55.12.5CNA
ICC15xx5.13.x – < 5.13.25.13.2CNA
ICC15xx5.20.x – < 5.20.25.20.2CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcert.vde.com/en/advisories/VDE-2021-047