CVE-2021-34602CWE-78

Bender Charge Controller: Long URL could lead to webserver crash

High · published April 27, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
72.1
In the wild
Unconfirmed
What it is

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01391 · 72.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2022-04-27T15:15Z
EPSS history
Timeline
  • 27 APR 15:15Z
    Bender Charge Controller: Long URL could lead to webserver crash
    cvelistv5