Lucene search

CERTVDECVE-2021-34587

HistoryApr 27, 2022 - 4:15 p.m.

CVE-2021-34587

2022-04-2716:15:10

CWE-787

CWE-121

CERTVDE

web.nvd.nist.gov

bender

ebee

charge controllers

cve-2021-34587

webserver crash

url

stack variable

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

32.7%

JSON

In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a stack variable.

Affected configurations

Nvd

Node

ibm_ibm_rational_lifecycle_integration_adapter_for_windchillMatch1.0.0

Node

bendercc612_firmwareRange5.11.0–5.11.2

bendercc612_firmwareRange5.12.0–5.12.5

bendercc612_firmwareRange5.13.0–5.13.2

bendercc612_firmwareRange5.20.0–5.20.2

AND

bendercc612Match-

Node

bendercc613_firmwareRange5.11.0–5.11.2

bendercc613_firmwareRange5.12.0–5.12.5

bendercc613_firmwareRange5.13.0–5.13.2

bendercc613_firmwareRange5.20.0–5.20.2

AND

bendercc613Match-

Node

bendericc15xx_firmwareRange5.11.0–5.11.2

bendericc15xx_firmwareRange5.12.0–5.12.5

bendericc15xx_firmwareRange5.13.0–5.13.2

bendericc15xx_firmwareRange5.20.0–5.20.2

AND

bendericc15xxMatch-

Node

bendericc16xx_firmwareRange5.11.0–5.11.2

bendericc16xx_firmwareRange5.12.0–5.12.5

bendericc16xx_firmwareRange5.13.0–5.13.2

bendericc16xx_firmwareRange5.20.0–5.20.2

AND

bendericc16xxMatch-

VendorProductVersionCPE
ibm_ibm_rational_lifecycle_integration_adapter_for_windchill1.0.0cpe:2.3:a:ibm:_ibm_rational_lifecycle_integration_adapter_for_windchill:1.0.0:*:*:*:*:*:*:*
bendercc612_firmware*cpe:2.3:o:bender:cc612_firmware:*:*:*:*:*:*:*:*
bendercc612-cpe:2.3:h:bender:cc612:-:*:*:*:*:*:*:*
bendercc613_firmware*cpe:2.3:o:bender:cc613_firmware:*:*:*:*:*:*:*:*
bendercc613-cpe:2.3:h:bender:cc613:-:*:*:*:*:*:*:*
bendericc15xx_firmware*cpe:2.3:o:bender:icc15xx_firmware:*:*:*:*:*:*:*:*
bendericc15xx-cpe:2.3:h:bender:icc15xx:-:*:*:*:*:*:*:*
bendericc16xx_firmware*cpe:2.3:o:bender:icc16xx_firmware:*:*:*:*:*:*:*:*
bendericc16xx-cpe:2.3:h:bender:icc16xx:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	_ibm_rational_lifecycle_integration_adapter_for_windchill	1.0.0	cpe:2.3:a:ibm:_ibm_rational_lifecycle_integration_adapter_for_windchill:1.0.0:::::::*
bender	cc612_firmware	*	cpe:2.3:o:bender:cc612_firmware::::::::
bender	cc612	-	cpe:2.3:h:bender:cc612:-:::::::*
bender	cc613_firmware	*	cpe:2.3:o:bender:cc613_firmware::::::::
bender	cc613	-	cpe:2.3:h:bender:cc613:-:::::::*
bender	icc15xx_firmware	*	cpe:2.3:o:bender:icc15xx_firmware::::::::
bender	icc15xx	-	cpe:2.3:h:bender:icc15xx:-:::::::*
bender	icc16xx_firmware	*	cpe:2.3:o:bender:icc16xx_firmware::::::::
bender	icc16xx	-	cpe:2.3:h:bender:icc16xx:-:::::::*

CNA Affected

[
  {
    "product": "CC612",
    "vendor": "Bender / ebee",
    "versions": [
      {
        "lessThan": "5.11.2",
        "status": "affected",
        "version": "5.11.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.12.5",
        "status": "affected",
        "version": "5.12.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.13.2",
        "status": "affected",
        "version": "5.13.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.20.2",
        "status": "affected",
        "version": "5.20.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "CC613",
    "vendor": "Bender / ebee",
    "versions": [
      {
        "lessThan": "5.11.2",
        "status": "affected",
        "version": "5.11.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.12.5",
        "status": "affected",
        "version": "5.12.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.13.2",
        "status": "affected",
        "version": "5.13.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.20.2",
        "status": "affected",
        "version": "5.20.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "ICC15xx",
    "vendor": "Bender / ebee",
    "versions": [
      {
        "lessThan": "5.11.2",
        "status": "affected",
        "version": "5.11.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.12.5",
        "status": "affected",
        "version": "5.12.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.13.2",
        "status": "affected",
        "version": "5.13.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.20.2",
        "status": "affected",
        "version": "5.20.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "ICC16xx",
    "vendor": "Bender / ebee",
    "versions": [
      {
        "lessThan": "5.11.2",
        "status": "affected",
        "version": "5.11.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.12.5",
        "status": "affected",
        "version": "5.12.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.13.2",
        "status": "affected",
        "version": "5.13.x",
        "versionType": "custom"
      },
      {
        "lessThan": "5.20.2",
        "status": "affected",
        "version": "5.20.x",
        "versionType": "custom"
      }
    ]
  }
]

References

cert.vde.com/en/advisories/VDE-2021-047

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

32.7%

JSON

Related for CVE-2021-34587