CVE-2021-41301

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

Score

CVSS 3.1 9.8 Critical

Status

Modified - twcert@cert.org.tw

Published

2021-09-30

Last modified

2024-09-16

Weaknesses

CWE-200, CWE-639

Affected products

• Ecs Router Controller-ecs Firmware (Ecoa)
• Ecs Router Controller Ecs Flash (Ecoa)
• Graphic Control Software (Ecoa)
• Riskbuster Firmware (Ecoa)
• Riskbuster System Rb 3.0.0 (Ecoa)
• Riskbuster System Trane 1.0 (Ecoa)
• Riskbuster Terminator E6l45 (Ecoa)
• Riskterminator (Ecoa)
• Smarthome Ii E9246 (Ecoa)

References

• https://www.twcert.org.tw/tw/cp-132-5137-730a6-1.html