CVE-2021-41301: falha crítica em ECOA ECS Router Controller ECS (FLASH)
ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 2.0%
ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
ECOA · ECS Router Controller ECS (FLASH)ECOA · Graphic Control SoftwareECOA · RiskBuster System RB 3.0.0ECOA · RiskBuster System TRANE 1.0ECOA · RiskBuster Terminator E6L45ECOA · RiskTerminatorECOA · SmartHome II E9246CVEs relacionadas — ECOA ECS Router Controller ECS (FLASH)
No mesmo produto, das mais perigosas para as menos.
CVE-2021-41291HIGHECOA BAS controller - Path Traversal-1EPSS 82.7%CVE-2021-41293HIGHECOA BAS controller - Path Traversal-3EPSS 19.9%CVE-2021-41290CRITICALECOA BAS controller - Path Traversal-1EPSS 2.3%CVE-2021-41299CRITICALECOA BAS controller - Use of Hard-coded CredentialsEPSS 2.1%CVE-2021-41294CRITICALECOA BAS controller - Path Traversal-4EPSS 1.2%CVE-2021-41292CRITICALECOA BAS controller - Broken AuthenticationEPSS 1.2%