What’s Vulnerable › Vulnerabilities

CVE-2021-34601: Bender Charge Controller: Hardcoded Credentials in Charge Controller

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-27 · updated 2026-06-17
• Weakness: CWE-259

Description

In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI.

Affected products

• Bender Cc612 Firmware: from 5.11.0 before 5.11.2; from 5.12.0 before 5.12.5; from 5.13.0 before 5.13.2; from 5.20.0 before 5.20.2 — fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2
• Bender Icc15Xx Firmware: from 5.11.0 before 5.11.2; from 5.12.0 before 5.12.5; from 5.13.0 before 5.13.2; from 5.20.0 before 5.20.2 — fixed in 5.11.2, 5.12.5, 5.13.2, 5.20.2

How to fix

Upgrade to a fixed version: Bender Cc612 Firmware 5.11.2, 5.12.5, 5.13.2, 5.20.2; Bender Icc15Xx Firmware 5.11.2, 5.12.5, 5.13.2, 5.20.2. Check the vendor advisory for mitigations.

References

• https://cert.vde.com/en/advisories/VDE-2021-047
• https://cert.vde.com/en/advisories/VDE-2021-047

Get alerted when CVE-2021-34601 or the next vulnerability affects your stack