CVE-2021-41301
ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor
- State
- Published
- Severity
- 9.8 Critical
- Published
- Sep 30, 2021
- Updated
- Sep 16, 2024
- Reserved
- Sep 15, 2021
Description
ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | twcert |
Weaknesses
- CWE-200 Information Exposure
Affected Products
| Product | Versions |
|---|---|
ECS Router Controller ECS (FLASH)ECOA |
|
RiskBuster Terminator E6L45ECOA |
|
RiskBuster System RB 3.0.0ECOA |
|
RiskBuster System TRANE 1.0ECOA |
|
Graphic Control SoftwareECOA |
|
SmartHome II E9246ECOA |
|
RiskTerminatorECOA |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.