CVE-2021-41293

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

20.62% chance of exploitation in the next 30 days, 97th percentile

Nuclei

high · CWE-22

Published

2021-09-30

Updated

2024-09-16

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41293.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-41291
• CVE-2021-4130
• CVE-2021-41285
• CVE-2021-4131
• CVE-2021-41282
• CVE-2021-41314