title: Bender Charge Controller: Hardcoded Credentials in Charge Controller
description: In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI.
problem types: CWE-259 Use of Hard-coded Password
affected:
{
product: CC612
vendor: Bender / ebee
versions:
lessThan: 5.11.2, status: affected, version: 5.11.x, versionType: custom
lessThan: 5.12.5, status: affected, version: 5.12.x, versionType: custom
lessThan: 5.13.2, status: affected, version: 5.13.x, versionType: custom
lessThan: 5.20.2, status: affected, version: 5.20.x, versionType: custom
}
{
product: CC613
vendor: Bender / ebee
versions:
lessThan: 5.11.2, status: affected, version: 5.11.x, versionType: custom
lessThan: 5.12.5, status: affected, version: 5.12.x, versionType: custom
lessThan: 5.13.2, status: affected, version: 5.13.x, versionType: custom
lessThan: 5.20.2, status: affected, version: 5.20.x, versionType: custom
}
{
product: ICC15xx
vendor: Bender / ebee
versions:
lessThan: 5.11.2, status: affected, version: 5.11.x, versionType: custom
lessThan: 5.12.5, status: affected, version: 5.12.x, versionType: custom
lessThan: 5.13.2, status: affected, version: 5.13.x, versionType: custom
lessThan: 5.20.2, status: affected, version: 5.20.x, versionType: custom
}
{
product: ICC16xx
vendor: Bender / ebee
versions:
lessThan: 5.11.2, status: affected, version: 5.11.x, versionType: custom
lessThan: 5.12.5, status: affected, version: 5.12.x, versionType: custom
lessThan: 5.13.2, status: affected, version: 5.13.x, versionType: custom
lessThan: 5.20.2, status: affected, version: 5.20.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]