CVE-2021-34601: Bender CC612 Firmware

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI.

Affected products

• Bender CC612 Firmware: from 5.11.0, before 5.11.2 (fixed in 5.11.2); from 5.12.0, before 5.12.5 (fixed in 5.12.5); from 5.13.0, before 5.13.2 (fixed in 5.13.2); from 5.20.0, before 5.20.2 (fixed in 5.20.2)
• Bender ICC15XX Firmware: from 5.11.0, before 5.11.2 (fixed in 5.11.2); from 5.12.0, before 5.12.5 (fixed in 5.12.5); from 5.13.0, before 5.13.2 (fixed in 5.13.2); from 5.20.0, before 5.20.2 (fixed in 5.20.2)

Published 2022-04-27. Last modified 2026-06-17.