CVE-2021-34589: Bender Charge Controller: RFID leak

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-27 · updated 2026-06-17
Weakness: CWE-200

Description

In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface.

Affected products

Bender Cc612 Firmware: from 5.11.0 before 5.11.2; from 5.12.0 before 5.12.5; from 5.13.0 before 5.13.2; from 5.20.0 before 5.20.2 — fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
Bender Cc613 Firmware: from 5.11.0 before 5.11.2; from 5.13.0 before 5.13.2; from 5.20.0 before 5.20.2 — fixed in 5.11.2, 5.13.2, 5.20.2
Bender Icc15Xx Firmware: from 5.11.0 before 5.11.2; from 5.12.0 before 5.12.5; from 5.13.0 before 5.13.2; from 5.20.0 before 5.20.2 — fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
Bender Icc16Xx Firmware: from 5.11.0 before 5.11.2; from 5.12.0 before 5.12.5; from 5.13.0 before 5.13.2; from 5.20.0 before 5.20.2 — fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
Bender Icc613 Firmware: from 5.12.0 before 5.12.5 — fixed in 5.12.5

How to fix

Upgrade to a fixed version: Bender Cc612 Firmware 5.11.2, 5.12.5, 5.13.2, 5.20.2; Bender Cc613 Firmware 5.11.2, 5.13.2, 5.20.2; Bender Icc15Xx Firmware 5.11.2, 5.12.5, 5.13.2, 5.20.2; Bender Icc16Xx Firmware 5.11.2, 5.12.5, 5.13.2, 5.20.2; Bender Icc613 Firmware 5.12.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34589 or the next vulnerability affects your stack