CVE-2021-41297

ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts in plain-text.

Score

CVSS 3.1 8.8 High

Status

Modified - twcert@cert.org.tw

Published

2021-09-30

Last modified

2024-09-16

Weaknesses

CWE-522

Affected products

• Ecs Router Controller-ecs Firmware (Ecoa)
• Ecs Router Controller Ecs Flash (Ecoa)
• Graphic Control Software (Ecoa)
• Riskbuster Firmware (Ecoa)
• Riskbuster System Rb 3.0.0 (Ecoa)
• Riskbuster System Trane 1.0 (Ecoa)
• Riskbuster Terminator E6l45 (Ecoa)
• Riskterminator (Ecoa)
• Smarthome Ii E9246 (Ecoa)

References

• https://www.twcert.org.tw/tw/cp-132-5133-f3c4b-1.html