VulnerabilityModified

CVE-2021-41291

ECOA BAS controller suffers from a path traversal content disclosure vulnerability.

HIGH 7.5EPSS 82.7%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 82.7%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.

Description

ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 82.69% probability · 100th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: ecoa/ecs router controller-ecs firmware · ecoa/riskbuster firmware · ecoa/riskterminator
Source: twcert@cert.org.tw

References

https://www.twcert.org.tw/tw/cp-132-5127-3cbd3-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-5127-3cbd3-1.htmlThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.