by Kastro
Paper/Archive/CVE-2021-41294

CVE-2021-41294

ECOA ECS Router Controller ECS (FLASH) — ECOA BAS controller - Path Traversal-4

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 67.8.678 × 2013.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario.

Affected

ProductAffectedFixed inSource
ECS Router Controller ECS (FLASH)see advisory–CNA
RiskBuster Terminator E6L45see advisory–CNA
RiskBuster System RB 3.0.0see advisory–CNA
RiskBuster System TRANE 1.0see advisory–CNA
Graphic Control Softwaresee advisory–CNA
SmartHome II E9246see advisory–CNA
RiskTerminatorsee advisory–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
twcert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-5130-7de92-1.html