CVEvulnerability

CVE-2021-41301

9.8 CRITICAL Published 2021-09-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-09-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-200, CWE-639

Description

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

Affected configurations

• ecoa ecs router controller-ecs firmware • ecoa riskbuster firmware • ecoa riskterminator

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References