Command injection

2022-04-2716:15:00

PRIOn knowledge base

www.prio-n.com

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.9%

JSON

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.

CPENameOperatorVersion
cc612_firmwarege5.11.0
cc612_firmwarelt5.11.2
cc612_firmwarege5.12.0
cc612_firmwarelt5.12.5
cc612_firmwarege5.13.0
cc612_firmwarelt5.13.2
cc612_firmwarege5.20.0
cc612_firmwarelt5.20.2
icc15xx_firmwarege5.11.0
icc15xx_firmwarelt5.11.2

Name	Operator	Version
cc612_firmware	ge	5.11.0
cc612_firmware	lt	5.11.2
cc612_firmware	ge	5.12.0
cc612_firmware	lt	5.12.5
cc612_firmware	ge	5.13.0
cc612_firmware	lt	5.13.2
cc612_firmware	ge	5.20.0
cc612_firmware	lt	5.20.2
icc15xx_firmware	ge	5.11.0
icc15xx_firmware	lt	5.11.2

Rows per page:

1-10 of 321

References

cert.vde.com/en/advisories/VDE-2021-047