CVE-2021-34602: Bender / ebee CC612, инжекция

Описание

Оригинално описание

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.

Засегнати продукти

• Bender / ebee CC612: 5.11.x преди 5.11.2; 5.12.x преди 5.12.5; 5.13.x преди 5.13.2; 5.20.x преди 5.20.2
• Bender / ebee CC613: 5.11.x преди 5.11.2; 5.12.x преди 5.12.5; 5.13.x преди 5.13.2; 5.20.x преди 5.20.2
• Bender / ebee ICC15xx: 5.11.x преди 5.11.2; 5.12.x преди 5.12.5; 5.13.x преди 5.13.2; 5.20.x преди 5.20.2
• Bender / ebee ICC16xx: 5.11.x преди 5.11.2; 5.12.x преди 5.12.5; 5.13.x преди 5.13.2; 5.20.x преди 5.20.2

Вид слабост

• CWE-78 Инжектиране на команди към операционната система

История

Други уязвимости в Bender / ebee CC612

• 9.8CVE-2021-34601
• 8.8CVE-2021-34592
• 7.8CVE-2021-34591
• 5.4CVE-2021-34590
• 7.5CVE-2021-34589

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-34602
• https://nvd.nist.gov/vuln/detail/CVE-2021-34602
• https://cert.vde.com/en/advisories/VDE-2021-047