CVE-2021-34590: Bender CC612 Firmware

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed.

Affected products

• Bender CC612 Firmware: from 5.11.0, before 5.11.2 (fixed in 5.11.2); from 5.12.0, before 5.12.5 (fixed in 5.12.5); from 5.13.0, before 5.13.2 (fixed in 5.13.2); from 5.20.0, before 5.20.2 (fixed in 5.20.2)
• Bender ICC15XX Firmware: from 5.11.0, before 5.11.2 (fixed in 5.11.2); from 5.12.0, before 5.12.5 (fixed in 5.12.5); from 5.13.0, before 5.13.2 (fixed in 5.13.2); from 5.20.0, before 5.20.2 (fixed in 5.20.2)

Published 2022-04-27. Last modified 2026-06-17.