vde-2025-061
HIGH CVSS 8.8 csaf_bendergmbhcokg
Description
Bender is publishing this advisory to inform customers about a security vulnerability in the Charge Controller product families. Bender has analyzed the weakness and determined that the electrical safety of the devices is not affected. Bender considers the weakness to be of high risk and it should be patched immediately.
Timeline
- Published
- 2025-09-08 07:00 UTC
- Last Modified
- 2025-09-08
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"document": {
"acknowledgments": [
{
"organization": "CERT@VDE",
"summary": "coordination",
"urls": [
"https://certvde.com"
]
},
{
"names": [
"Dr. Matthias Kesenheimer",
"Sebastian Hamann"
],
"organization": " SySS GmbH",
"summary": "reporting",
"urls": [
"https://www.syss.de"
]
}
],
"aggregate_severity": {
"namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
"text": "High"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-GB",
"notes": [
{
"category": "summary",
"text": "Bender is publishing this advisory to inform customers about a security vulnerability in the Charge Controller product families. Bender has analyzed the weakness and determined that the electrical safety of the devices is not affected. Bender considers the weakness to be of high risk and it should be patched immediately.",
"title": "Summary"
},
{
"category": "description",
"text": "The vulnerability allows an authenticated user with lower privileges to obtain credentials stored on the charge controller including the manufacturer password.",
"title": "Impact"
},
{
"category": "description",
"text": "To prevent an authenticated user from obtaining stored credentials install version 5.33.3 or later.",
"title": "Remediation"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@bender.de",
"name": "Bender GmbH & Co. KG",
"namespace": "https://www.bender.de"
},
"references": [
{
"category": "self",
"summary": "VDE-2025-061: Bender Charge Controller Vulnerability - Disclosure Of Stored Credentials When Authenticated - HTML",
"url": "https://certvde.com/en/advisories/VDE-2025-061/"
},
{
"category": "self",
"summary": "VDE-2025-061: Bender Charge Controller Vulnerability - Disclosure Of Stored Credentials When Authenticated - CSAF",
"url": "https://bender.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-061.json"
},
{
"category": "external",
"summary": "Vendor PSIRT",
"url": "https://www.bender.de"
},
{
"category": "external",
"summary": "CERT@VDE Security Advisories for Bender GmbH & Co. KG",
"url": "https://certvde.com/en/advisories/vendor/bender/"
}
],
"title": "Bender Charge Controller Vulnerability - Disclosure Of Stored Credentials When Authenticated",
"tracking": {
"aliases": [
"VDE-2025-061"
],
"current_release_date": "2025-09-08T07:00:00.000Z",
"generator": {
"date": "2025-09-05T09:02:01.467Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.34"
}
},
"id": "VDE-2025-061",
"initial_release_date": "2025-09-08T07:00:00.000Z",
"revision_history": [
{
"date": "2025-09-08T07:00:00.000Z",
"number": "1",
"summary": "initial version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "CC612",
"product": {
"name": "CC612",
"product_id": "CSAFPID-11001"
}
},
{
"category": "product_name",
"name": "CC613",
"product": {
"name": "CC613",
"product_id": "CSAFPID-11002"
}
},
{
"category": "product_name",
"name": "ICC16xx",
"product": {
"name": "ICC16xx",
"product_id": "CSAFPID-11003"
}
},
{
"category": "product_name",
"name": "ICC13xx",
"product": {
"name": "ICC13xx",
"product_id": "CSAFPID-11004"
}
}
],
"category": "product_family",
"name": "Hardware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "5.30.2<5.33.3",
"product": {
"name": "Firmware 5.30.2<5.33.3",
"product_id": "CSAFPID-21001"
}
},
{
"category": "product_version",
"name": "5.33.3",
"product": {
"name": "Firmware 5.33.3",
"product_id": "CSAFPID-22001"
}
}
],
"category": "product_family",
"name": "Firmware"
}
],
"category": "vendor",
"name": "Bender"
}
],
"product_groups": [
{
"group_id": "CSAFGID-0001",
"product_ids": [
"CSAFPID-31001",
"CSAFPID-31002",
"CSAFPID-31003",
"CSAFPID-31004"
],
"summary": "Affected products"
},
{
"group_id": "CSAFGID-0002",
"product_ids": [
"CSAFPID-32001",
"CSAFPID-32002",
"CSAFPID-32003",
"CSAFPID-32004"
],
"summary": "Fixed products"
}
],
"relationships": [
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 5.30.2<5.33.3 installed on CC612",
"product_id": "CSAFPID-31001"
},
"product_reference": "CSAFPID-21001",
"relates_to_product_reference": "CSAFPID-11001"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 5.30.2<5.33.3 installed on CC613",
"product_id": "CSAFPID-31002"
},
"product_reference": "CSAFPID-21001",
"relates_to_product_reference": "CSAFPID-11002"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 5.30.2<5.33.3 installed on ICC16xx",
"product_id": "CSAFPID-31003"
},
"product_reference": "CSAFPID-21001",
"relates_to_product_reference": "CSAFPID-11003"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 5.30.2<5.33.3 installed on ICC13xx",
"product_id": "CSAFPID-31004"
},
"product_reference": "CSAFPID-21001",
"relates_to_product_reference": "CSAFPID-11004"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 5.33.3 installed on CC612",
"product_id": "CSAFPID-32001"
},
"product_reference": "CSAFPID-22001",
"relates_to_product_reference": "CSAFPID-11001"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 5.33.3 installed on CC613",
"product_id": "CSAFPID-32002"
},
"product_reference": "CSAFPID-22001",
"relates_to_product_reference": "CSAFPID-11002"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 5.33.3 installed on ICC16xx",
"product_id": "CSAFPID-32003"
},
"product_reference": "CSAFPID-22001",
"relates_to_product_reference": "CSAFPID-11003"
},
{
"category": "installed_on",
"full_product_name": {
"name": "Firmware 5.33.3 installed on ICC13xx",
"product_id": "CSAFPID-32004"
},
"product_reference": "CSAFPID-22001",
"relates_to_product_reference": "CSAFPID-11004"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-41682",
"cwe": {
"id": "CWE-522",
"name": "Insufficiently Protected Credentials"
},
"notes": [
{
"category": "description",
"text": "An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-32001",
"CSAFPID-32002",
"CSAFPID-32003",
"CSAFPID-32004"
],
"known_affected": [
"CSAFPID-31001",
"CSAFPID-31002",
"CSAFPID-31003",
"CSAFPID-31004"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Install software update 5.33.3 or later.",
"group_ids": [
"CSAFGID-0001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-31001",
"CSAFPID-31002",
"CSAFPID-31003",
"CSAFPID-31004"
]
}
],
"title": "CVE-2025-41682"
}
]
}