CVE-2021-34591
📋 TL;DR
This vulnerability allows authenticated attackers to escalate privileges to root on Bender/ebee Charge Controllers by exploiting SUID permissions on socat, ip, udhcpc, and ifplugd applications. It affects multiple versions of these electric vehicle charging controllers. Attackers with local access can gain complete system control.
💻 Affected Systems
- Bender/ebee Charge Controllers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the charging controller allowing attackers to manipulate charging operations, steal sensitive data, or use the device as a pivot point into other network systems.
Likely Case
Local attackers gaining root access to modify system configurations, install persistent backdoors, or disrupt charging operations.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized local access to the controllers.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once local access is obtained. The SUID misconfiguration makes privilege escalation simple.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in provided references
Vendor Advisory: https://cert.vde.com/en/advisories/VDE-2021-047
Restart Required: Yes
Instructions:
1. Contact Bender for updated firmware. 2. Apply vendor-provided patches. 3. Restart affected charge controllers. 4. Verify SUID permissions are removed from vulnerable applications.
🔧 Temporary Workarounds
Remove SUID permissions
linuxRemove setuid bit from vulnerable applications to prevent privilege escalation
chmod u-s /usr/bin/socat
chmod u-s /sbin/ip
chmod u-s /sbin/udhcpc
chmod u-s /sbin/ifplugd
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local access to charge controllers
- Network segmentation to isolate charge controllers from other critical systems
🔍 How to Verify
Check if Vulnerable:
Check SUID permissions: find / -type f -perm -4000 -exec ls -la {} \; 2>/dev/null | grep -E 'socat|ip|udhcpc|ifplugd'Check Version:
Check controller firmware version via vendor-specific interface or documentationVerify Fix Applied:
Verify SUID bits are removed: ls -la /usr/bin/socat /sbin/ip /sbin/udhcpc /sbin/ifplugd | grep -v '^-rws'📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts
- Execution of socat/ip/udhcpc/ifplugd with elevated privileges
- Authentication logs showing unauthorized access
Network Indicators:
- Unexpected network connections from charge controllers
- Unusual traffic patterns from controller management interfaces
SIEM Query:
process.name IN ('socat', 'ip', 'udhcpc', 'ifplugd') AND user.name != 'root' AND process.effective_user.name == 'root'