EIP-2026-101682

PRE-CVE

ECOA Building Automation System - Directory Traversal Content Disclosure

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-101682. PoCs published by Neurogenesia.

AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in ECOA Building Automation System via the 'cpath' parameter in the File Manager (fmangersub) component. Attackers can disclose directory contents by manipulating the 'cpath' parameter in GET requests.

Description

ECOA Building Automation System - Directory Traversal Content Disclosure

Exploits (1)

exploitdb WORKING POC
by Neurogenesia · textwebappshardware
https://www.exploit-db.com/exploits/50277

This exploit demonstrates a directory traversal vulnerability in ECOA Building Automation System via the 'cpath' parameter in the File Manager (fmangersub) component. Attackers can disclose directory contents by manipulating the 'cpath' parameter in GET requests.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: ECOA Building Automation System (various versions including ECS Router Controller, RiskBuster Terminator, etc.)
No auth needed
Prerequisites: Network access to the target system · File Manager (fmangersub) component enabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026