Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2021-41293

ECOA BAS controller - Path Traversal-3

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
twcert

Description

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ECOA ECS Router Controller ECS (FLASH)

  • next of 0 to < unspecifiedunknown

ECOA RiskBuster Terminator E6L45

  • next of 0 to < unspecifiedunknown

ECOA RiskBuster System RB 3.0.0

  • next of 0 to < unspecifiedunknown

ECOA RiskBuster System TRANE 1.0

  • next of 0 to < unspecifiedunknown

ECOA Graphic Control Software

  • next of 0 to < unspecifiedunknown

ECOA SmartHome II E9246

  • next of 0 to < unspecifiedunknown

ECOA RiskTerminator

  • next of 0 to < unspecifiedunknown

References