Lucene search

[email protected]CVE-2021-34591

HistoryApr 27, 2022 - 4:15 p.m.

CVE-2021-34591

2022-04-2716:15:11

CWE-250

[email protected]

web.nvd.nist.gov

bender

ebee

charge controllers

cve-2021-34591

local privilege escalation

nvd

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd.

Affected configurations

NVD

Node

bendercc612_firmwareRange5.11.0–5.11.2

bendercc612_firmwareRange5.12.0–5.12.5

bendercc612_firmwareRange5.13.0–5.13.2

bendercc612_firmwareRange5.20.0–5.20.2

AND

bendercc612Match-

Node

bendercc613Match-

AND

bendericc15xx_firmwareRange5.11.0–5.11.2

bendericc15xx_firmwareRange5.12.0–5.12.5

bendericc15xx_firmwareRange5.13.0–5.13.2

bendericc15xx_firmwareRange5.20.0–5.20.2

Node

bendercc613Match-

AND

bendericc15xx_firmwareRange5.11.0–5.11.2

bendericc15xx_firmwareRange5.12.0–5.12.5

bendericc15xx_firmwareRange5.13.0–5.13.2

bendericc15xx_firmwareRange5.20.0–5.20.2

Node

bendercc613Match-

AND

bendericc15xx_firmwareRange5.11.0–5.11.2

bendericc15xx_firmwareRange5.12.0–5.12.5

bendericc15xx_firmwareRange5.13.0–5.13.2

bendericc15xx_firmwareRange5.20.0–5.20.2

CPENameOperatorVersion
bender:cc612_firmwarebender cc612 firmwarelt5.11.2
bender:cc612_firmwarebender cc612 firmwarelt5.12.5
bender:cc612_firmwarebender cc612 firmwarelt5.13.2
bender:cc612_firmwarebender cc612 firmwarelt5.20.2

CPE	Name	Operator	Version
bender:cc612_firmware	bender cc612 firmware	lt	5.11.2
bender:cc612_firmware	bender cc612 firmware	lt	5.12.5
bender:cc612_firmware	bender cc612 firmware	lt	5.13.2
bender:cc612_firmware	bender cc612 firmware	lt	5.20.2

CNA Affected

[
  {
    "product": "CC612",
    "vendor": "Bender / ebee",
    "versions": [
      {
        "lessThan": "5.11.2",
        "status": "affected",
        "version": "5.11.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.12.5",
        "status": "affected",
        "version": "5.12.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.13.2",
        "status": "affected",
        "version": "5.13.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.20.2",
        "status": "affected",
        "version": "5.20.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "CC613",
    "vendor": "Bender / ebee",
    "versions": [
      {
        "lessThan": "5.11.2",
        "status": "affected",
        "version": "5.11.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.12.5",
        "status": "affected",
        "version": "5.12.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.13.2",
        "status": "affected",
        "version": "5.13.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.20.2",
        "status": "affected",
        "version": "5.20.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "ICC15xx",
    "vendor": "Bender / ebee",
    "versions": [
      {
        "lessThan": "5.11.2",
        "status": "affected",
        "version": "5.11.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.12.5",
        "status": "affected",
        "version": "5.12.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.13.2",
        "status": "affected",
        "version": "5.13.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.20.2",
        "status": "affected",
        "version": "5.20.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "ICC16xx",
    "vendor": "Bender / ebee",
    "versions": [
      {
        "lessThan": "5.11.2",
        "status": "affected",
        "version": "5.11.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.12.5",
        "status": "affected",
        "version": "5.12.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.13.2",
        "status": "affected",
        "version": "5.13.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.20.2",
        "status": "affected",
        "version": "5.20.x",
        "versionType": "custom"
      }
    ]
  }
]

References

cert.vde.com/en/advisories/VDE-2021-047

Social References

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-34591

prion1 cvelist1 nvd1