CVE-2021-34590

CVE-2021-34590 affects Bender/ebee Charge Controllers. The issue is a Cross-site Scripting vulnerability where authenticated attackers can inject HTML code into configuration values, which are not properly escaped when displayed. Multiple sources confirm the vulnerability across several product l...

CVE-2021-34589

CVE-2021-34589 concerns the RFID leak in Bender/ebee Charge Controllers . Affected products include multiple versions of the Bender ebee Charge Controllers, where the RFID data from the last charge event can be read without authentication through the web interface. The available documents corrobo...

CVE-2021-34589 Bender Charge Controller: RFID leak

In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface...

CVE-2021-34588 Bender Charge Controller: Unprotected data export

In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot...

CVE-2021-34587 Bender Charge Controller: Long URL could lead to webserver crash

In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a stack variable...

CVE-2021-34587

Summary: CVE-2021-34587 affects Bender ebee Charge Controllers (CC612, CC613, ICC15xx/ICC16xx) with versions prior to 5.11.2, 5.12.5, 5.13.2, or 5.20.2. A long URL used as input to sprintf into a stack variable can crash the webserver. CNNVD notes this could allow bypassing credential checks and ...

CVE-2021-34602

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges...

CVE-2021-34590

In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed...

CVE-2021-34601

In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI...

CVE-2021-34589

In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface...

PT-2022-10361 · Unknown · Bender/Ebee Charge Controllers

Name of the Vulnerable Software and Affected Versions: Bender/ebee Charge Controllers affected versions not specified Description: The issue allows an authenticated attacker to perform Cross-site Scripting by writing HTML code into configuration values, which are not properly escaped when...

Bender ebee 充电控制器 跨站脚本漏洞

ebee is a charge controller from Bender. A cross-site scripting vulnerability exists in the Bender ebee Charge Controller that stems from easy cross-site scripting. An authenticated attacker could write HTML code to configuration values. These values are not properly escaped when displayed. The...

Bender ebee 充电控制器 信任管理问题漏洞

The ebee is a charge controller from Bender. A security vulnerability exists in the Bender ebee Charge Controller that stems from the susceptibility to hard-coded credentials. An attacker may be able to use a password to gain administrative access to the Web UI. The following products and version...

Bender ebee 充电控制器 缓冲区错误漏洞

The ebee is a charge controller from Bender. A security vulnerability exists in the Bender ebee Charge Controller that stems from a long URL that could cause the web server to crash. An attacker can exploit this vulnerability to bypass credential checks and elevate privileges. The following...

PT-2022-10363 · Unknown · Bender/Ebee Charge Controllers

Name of the Vulnerable Software and Affected Versions: Bender/ebee Charge Controllers affected versions not specified Description: The issue allows for Command injection via the Web interface. An authenticated attacker could enter shell commands into some input fields. Recommendations: At the...

Bender ebee 充电控制器 信息泄露漏洞

The ebee is a charge controller from Bender. An information disclosure vulnerability exists in the Bender ebee Charge Controller, which stems from an RFID leak that allows the RFID of the last charging event to be read via the web interface without authentication.An attacker can exploit this...

PT-2022-10360 · Unknown · Bender/Ebee Charge Controllers

Name of the Vulnerable Software and Affected Versions: Bender/ebee Charge Controllers affected versions not specified Description: The issue concerns an RFID leak in Bender/ebee Charge Controllers. The RFID of the last charge event can be read without authentication via the web interface...

Bender ebee 充电控制器 安全漏洞

The ebee is a charge controller from Bender. A security vulnerability exists in the Bender ebee Charge Controller that stems from an easy local privilege escalation. An authenticated attacker can gain root access via the suid application socat, ip udhcpc, and ifplugd. The following products and...

Bender ebee 充电控制器 操作系统命令注入漏洞

The ebee is a charge controller from Bender. The Bender ebee Charge Controller suffers from an operating system command injection vulnerability that stems from easy command injection via the web interface. An authenticated attacker could enter shell commands into certain input fields executed wit...

Use of IERC20.transfer() instead of SafeERC20.safeTransfer()

Lines of code Vulnerability details Impact There are multiple external calls to IERC20.transfer that suppose to transfer out tokens from the system. However, there are tokens like USDT that don't return any return value in their implementation of the transfer function, so calling IERC20.transfer ...