by Kastro
Paper/Archive/CVE-2021-41296

CVE-2021-41296

ECOA ECS Router Controller ECS (FLASH) — ECOA BAS controller - Weak Password Requirements

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.2.612 × 2012.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.

Affected

ProductAffectedFixed inSource
ECS Router Controller ECS (FLASH)see advisory–CNA
RiskBuster Terminator E6L45see advisory–CNA
RiskBuster System RB 3.0.0see advisory–CNA
RiskBuster System TRANE 1.0see advisory–CNA
Graphic Control Softwaresee advisory–CNA
SmartHome II E9246see advisory–CNA
RiskTerminatorsee advisory–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-5132-65705-1.html