by Kastro
Paper/Archive/CVE-2021-41300

CVE-2021-41300

ECOA ECS Router Controller ECS (FLASH) — ECOA BAS controller - Insufficiently Protected Credentials-2

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.2.622 × 2012.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionality.

Affected

ProductAffectedFixed inSource
ECS Router Controller ECS (FLASH)see advisory–CNA
RiskBuster Terminator E6L45see advisory–CNA
RiskBuster System RB 3.0.0see advisory–CNA
RiskBuster System TRANE 1.0see advisory–CNA
Graphic Control Softwaresee advisory–CNA
SmartHome II E9246see advisory–CNA
RiskTerminatorsee advisory–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-5136-3e315-1.html