PT-2022-10365 · Unknown · Bender/Ebee Charge Controllers

Published 2022-04-27 · Updated 2022-05-11 · CVE-2021-34601

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bender/ebee Charge Controllers versions 5.20.1 and below

Description The issue concerns hardcoded credentials in the charge controllers, specifically hardcoded ssh credentials. This could allow an attacker to gain administrative access to the web-UI using the hardcoded password.

Recommendations For versions 5.20.1 and below, consider changing the default ssh credentials to unique and strong passwords as a temporary workaround, and look for an update from the manufacturer that addresses the hardcoded credentials issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-259

Related Identifiers

CVE-2021-34601

Affected Products

Bender/Ebee Charge Controllers

References · 3

• https://osv.dev/vulnerability/CVE-2021-34601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34601 · Security Note
• https://cert.vde.com/en/advisories/VDE-2021-047 · Vendor Advisory