Description
ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ECOA ECS Router Controller ECS (FLASH)
next of 0 to < unspecifiedunknown
ECOA RiskBuster Terminator E6L45
next of 0 to < unspecifiedunknown
ECOA RiskBuster System RB 3.0.0
next of 0 to < unspecifiedunknown
ECOA RiskBuster System TRANE 1.0
next of 0 to < unspecifiedunknown
ECOA Graphic Control Software
next of 0 to < unspecifiedunknown
ECOA SmartHome II E9246
next of 0 to < unspecifiedunknown
ECOA RiskTerminator
next of 0 to < unspecifiedunknown