by Kastro
Paper/Archive/CVE-2021-41301

CVE-2021-41301

ECOA ECS Router Controller ECS (FLASH) — ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 80.6.806 × 2016.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

Affected

ProductAffectedFixed inSource
ECS Router Controller ECS (FLASH)see advisory–CNA
RiskBuster Terminator E6L45see advisory–CNA
RiskBuster System RB 3.0.0see advisory–CNA
RiskBuster System TRANE 1.0see advisory–CNA
Graphic Control Softwaresee advisory–CNA
SmartHome II E9246see advisory–CNA
RiskTerminatorsee advisory–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-5137-730a6-1.html