CVE-2021-41290: critical vulnerability in ECOA ECS Router Controller ECS (FLASH)
ECOA BAS controller - Path Traversal-1
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 2.3%
ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
ECOA · ECS Router Controller ECS (FLASH)ECOA · Graphic Control SoftwareECOA · RiskBuster System RB 3.0.0ECOA · RiskBuster System TRANE 1.0ECOA · RiskBuster Terminator E6L45ECOA · RiskTerminatorECOA · SmartHome II E9246Related CVEs — ECOA ECS Router Controller ECS (FLASH)
In the same product, most dangerous first.
CVE-2021-41291HIGHECOA BAS controller - Path Traversal-1EPSS 82.7%CVE-2021-41293HIGHECOA BAS controller - Path Traversal-3EPSS 19.9%CVE-2021-41299CRITICALECOA BAS controller - Use of Hard-coded CredentialsEPSS 2.1%CVE-2021-41301CRITICALECOA BAS controller - Exposure of Sensitive Information to an Unauthorized ActorEPSS 2.0%CVE-2021-41294CRITICALECOA BAS controller - Path Traversal-4EPSS 1.2%CVE-2021-41292CRITICALECOA BAS controller - Broken AuthenticationEPSS 1.2%