Bender manufactures a focused line of industrial control and networked device products, including the CC612 and CC613 controller families and related firmware, which occupy a prominent position in critical infrastructure and embedded-systems deployments. Vulnerabilities affecting this vendor skew toward serious outcomes, with a meaningful share reaching critical severity, and recur across multiple weakness classes including direct-request flaws, privilege-escalation conditions, information disclosure, cross-site scripting, and command injection—patterns that reflect both web-interface and firmware-level attack surfaces. Defenders should treat Bender product advisories as high-priority given the vendor's prevalence in control environments; current severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Bender over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-34601CRITICAL In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh cred | Apr 27, 2022 | 9.8 | 29 | NO | NO |
CVE-2021-34602HIGH In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields | Apr 27, 2022 | 8.8 | 28 | NO | NO |
CVE-2021-34592HIGH In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields | Apr 27, 2022 | 8.8 | 28 | NO | NO |
CVE-2019-19885CRITICAL In Bender COMTRAXX, user authorization is validated for most, but not all, routes in the system. A user with knowledge about the routes can read and write configuration data withou | Oct 16, 2020 | 9.1 | 28 | NO | NO |
CVE-2021-34588HIGH In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty | Apr 27, 2022 | 8.6 | 27 | NO | NO |
CVE-2021-34591HIGH In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip | Apr 27, 2022 | 7.8 | 25 | NO | NO |
CVE-2021-34589HIGH In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface. | Apr 27, 2022 | 7.5 | 25 | NO | NO |
CVE-2021-34590MEDIUM In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values ar | Apr 27, 2022 | 5.4 | 20 | NO | NO |
CVE-2021-34587MEDIUM In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a stack variable. | Apr 27, 2022 | 5.3 | 20 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Bender.
Media articles that mention a CVE ID that affects a product developed by Bender — matched by CVE ID, not by vendor name.