CVE-2021-34601: Bender / ebee CC612, заобикаляне на вход и права

Описание

Оригинално описание

In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI.

Засегнати продукти

• Bender / ebee CC612: 5.11.x преди 5.11.2; 5.12.x преди 5.12.5; 5.13.x преди 5.13.2; 5.20.x преди 5.20.2
• Bender / ebee CC613: 5.11.x преди 5.11.2; 5.12.x преди 5.12.5; 5.13.x преди 5.13.2; 5.20.x преди 5.20.2
• Bender / ebee ICC15xx: 5.11.x преди 5.11.2; 5.12.x преди 5.12.5; 5.13.x преди 5.13.2; 5.20.x преди 5.20.2
• Bender / ebee ICC16xx: 5.11.x преди 5.11.2; 5.12.x преди 5.12.5; 5.13.x преди 5.13.2; 5.20.x преди 5.20.2

Вид слабост

• CWE-259 Използване на твърдо кодирана парола

История

Други уязвимости в Bender / ebee CC612

• 8.8CVE-2021-34602
• 8.8CVE-2021-34592
• 7.8CVE-2021-34591
• 5.4CVE-2021-34590
• 7.5CVE-2021-34589

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-34601
• https://nvd.nist.gov/vuln/detail/CVE-2021-34601
• https://cert.vde.com/en/advisories/VDE-2021-047