CVE-2021-34602: Bender CC612 Firmware

High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days.

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.

Affected products

• Bender CC612 Firmware: from 5.11.0, before 5.11.2 (fixed in 5.11.2); from 5.12.0, before 5.12.5 (fixed in 5.12.5); from 5.13.0, before 5.13.2 (fixed in 5.13.2); from 5.20.0, before 5.20.2 (fixed in 5.20.2)
• Bender ICC15XX Firmware: from 5.11.0, before 5.11.2 (fixed in 5.11.2); from 5.12.0, before 5.12.5 (fixed in 5.12.5); from 5.13.0, before 5.13.2 (fixed in 5.13.2); from 5.20.0, before 5.20.2 (fixed in 5.20.2)

Published 2022-04-27. Last modified 2026-06-17.