In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot .
Weakness
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cc612_firmware | Bender | 5.11.0 (including) | 5.11.2 (excluding) |
| Cc612_firmware | Bender | 5.12.0 (including) | 5.12.5 (excluding) |
| Cc612_firmware | Bender | 5.13.0 (including) | 5.13.2 (excluding) |
| Cc612_firmware | Bender | 5.20.0 (including) | 5.20.2 (excluding) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/127.html
- https://cwe.mitre.org/data/definitions/143.html
- https://cwe.mitre.org/data/definitions/144.html
- https://cwe.mitre.org/data/definitions/668.html
- https://cwe.mitre.org/data/definitions/87.html