SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2021-41292

ECOA BAS controller suffers from an authentication bypass vulnerability.

CRITICAL 9.1EPSS 1.17%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.

CVSS 3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
1.17% probability · 66th percentile
CISA KEV
Not listed
Weakness
CWE-288, CWE-287
Affected
ecoa/ecs router controller-ecs firmware · ecoa/riskbuster firmware · ecoa/riskterminator
Source
twcert@cert.org.tw

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.