CVE-2021-41293
ECOA BAS controller - Path Traversal-3
HIGH 7.5EPSS 19.9%
ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.
- Affected
- ECOA · ECS Router Controller ECS (FLASH) · RiskBuster Terminator E6L45 · RiskBuster System RB 3.0.0 · RiskBuster System TRANE 1.0 · Graphic Control Software · SmartHome II E9246
- CVSS v3.1 CERT
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N - EPSS
- 19.87% chance of exploitation in the next 30 days, 97th percentile
- Nuclei
- high · CWE-22
- Published
- 2021-09-30
- Updated
- 2024-09-16