EIP-2026-101679

PRE-CVE

ECOA Building Automation System - Arbitrary File Deletion

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-101679. PoCs published by Neurogenesia.

AI-analyzed exploit summary The exploit demonstrates an arbitrary file deletion vulnerability in ECOA Building Automation System by abusing the 'cfile' GET parameter in the fmanerdel applet, allowing attackers to delete files via directory traversal sequences.

Description

ECOA Building Automation System - Arbitrary File Deletion

Exploits (1)

exploitdb WORKING POC
by Neurogenesia · textwebappshardware
https://www.exploit-db.com/exploits/50286

The exploit demonstrates an arbitrary file deletion vulnerability in ECOA Building Automation System by abusing the 'cfile' GET parameter in the fmanerdel applet, allowing attackers to delete files via directory traversal sequences.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: ECOA Building Automation System (various versions including ECS Router Controller, RiskBuster System, etc.)
No auth needed
Prerequisites: Network access to the vulnerable system
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026