{"id":"CVE-2021-41290","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-41290","generatedAt":"2026-10-27T17:45:33.159Z","title":"ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability.","description":"ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.","published":"2021-09-30T11:15:07.000Z","lastModified":"2026-06-17T04:08:15.000Z","status":"Modified","sourceIdentifier":"twcert@cert.org.tw","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-434","CWE-22"],"affected":["ecoa/ecs router controller-ecs firmware","ecoa/riskbuster firmware","ecoa/riskterminator"],"epss":{"score":0.02322,"percentile":0.83355,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (2.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-5126-ca315-1.html","tags":["Third Party Advisory"],"source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-5126-ca315-1.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-41290","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}