CVE-2021-34590

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Bender / ebee	CC612	>= 5.11.x, < 5.11.2; >= 5.12.x, < 5.12.5; >= 5.13.x, < 5.13.2; >= 5.20.x, < 5.20.2
Bender / ebee	CC613	>= 5.11.x, < 5.11.2; >= 5.12.x, < 5.12.5; >= 5.13.x, < 5.13.2; >= 5.20.x, < 5.20.2
Bender / ebee	ICC15xx	>= 5.11.x, < 5.11.2; >= 5.12.x, < 5.12.5; >= 5.13.x, < 5.13.2; >= 5.20.x, < 5.20.2
Bender / ebee	ICC16xx	>= 5.11.x, < 5.11.2; >= 5.12.x, < 5.12.5; >= 5.13.x, < 5.13.2; >= 5.20.x, < 5.20.2

References

https://cert.vde.com/en/advisories/VDE-2021-047Vendor Advisory
https://cert.vde.com/en/advisories/VDE-2021-047Vendor Advisory

Timeline

Published: Apr 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-345917.8In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root acc CVE-2021-345928.8In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could ent CVE-2021-345937.5In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in se CVE-2021-345946.5TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a CVE-2021-345958.1A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinN CVE-2021-345966.5A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versio CVE-2021-345977.8Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a man CVE-2021-345987.5In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of me CVE-2021-345997.4Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not impleme CVE-2021-34609.8The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support CVE-2021-346005.5Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags use CVE-2021-346019.8In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1