VulnerabilityModified

CVE-2021-41294

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion.

CRITICAL 9.1EPSS 1.19%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.19%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS: 1.19% probability · 66th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: ecoa/ecs router controller-ecs firmware · ecoa/riskbuster firmware · ecoa/riskterminator
Source: twcert@cert.org.tw

References

https://www.twcert.org.tw/tw/cp-132-5130-7de92-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-5130-7de92-1.htmlThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.