CVE-2021-34601
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD
Description
In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI.
Affected (8)
Products: Bender: Cc612 Firmware, Icc15xx Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 5.11.0 to 5.11.2 |
| Running on/with | Platform Versions |
|---|---|
Bender Cc612 | All versions |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| From 5.11.0 to 5.11.2 |
| Running on/with | Platform Versions |
|---|---|
Bender Cc613 | All versions |
Related CWEs
CWE-259
Use of Hard-coded Password
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
CWE-798
Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
References (2)
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.