CVE-2021-41301

CRITICAL

ECOA BAS Controller - Unauthenticated Sensitive Information Disclosure via Direct Object Reference

Title source: llm

Description

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://www.twcert.org.tw/tw/cp-132-5137-730a6-1.html

Scores

CVSS v3 9.8

EPSS 0.0193

EPSS Percentile 77.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-200 CWE-639

Status published

Products (3)

ecoa/ecs_router_controller-ecs_firmware

ecoa/riskbuster_firmware

ecoa/riskterminator

Published Sep 30, 2021

Tracked Since Feb 18, 2026