CVE-2021-41294: falha crítica em ECOA ECS Router Controller ECS (FLASH)
ECOA BAS controller - Path Traversal-4
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 1.2%
ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
ECOA · ECS Router Controller ECS (FLASH)ECOA · Graphic Control SoftwareECOA · RiskBuster System RB 3.0.0ECOA · RiskBuster System TRANE 1.0ECOA · RiskBuster Terminator E6L45ECOA · RiskTerminatorECOA · SmartHome II E9246CVEs relacionadas — ECOA ECS Router Controller ECS (FLASH)
No mesmo produto, das mais perigosas para as menos.
CVE-2021-41291HIGHECOA BAS controller - Path Traversal-1EPSS 82.7%CVE-2021-41293HIGHECOA BAS controller - Path Traversal-3EPSS 19.9%CVE-2021-41290CRITICALECOA BAS controller - Path Traversal-1EPSS 2.3%CVE-2021-41299CRITICALECOA BAS controller - Use of Hard-coded CredentialsEPSS 2.1%CVE-2021-41301CRITICALECOA BAS controller - Exposure of Sensitive Information to an Unauthorized ActorEPSS 2.0%CVE-2021-41292CRITICALECOA BAS controller - Broken AuthenticationEPSS 1.2%