CVE-2021-41290
ECOA BAS controller - Path Traversal-1
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.
El controlador ECOA BAS sufre una vulnerabilidad de escritura de archivos arbitraria y de salto de ruta. usando los parámetros POST, unos atacantes no autenticados pueden establecer remotamente valores arbitrarios para la ubicación y el tipo de contenido y conseguir la posibilidad de ejecutar código arbitrario en el dispositivo afectado
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-09-15 CVE Reserved
- 2021-09-30 CVE Published
- 2024-09-16 CVE Updated
- 2024-12-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://www.twcert.org.tw/tw/cp-132-5126-ca315-1.html | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ecoa Search vendor "Ecoa" | Ecs Router Controller-ecs Firmware Search vendor "Ecoa" for product "Ecs Router Controller-ecs Firmware" | - | - |
Affected
| in | Ecoa Search vendor "Ecoa" | Ecs Router Controller-ecs Search vendor "Ecoa" for product "Ecs Router Controller-ecs" | - | - |
Safe
|
| Ecoa Search vendor "Ecoa" | Riskbuster Firmware Search vendor "Ecoa" for product "Riskbuster Firmware" | - | - |
Affected
| in | Ecoa Search vendor "Ecoa" | Riskbuster Search vendor "Ecoa" for product "Riskbuster" | - | - |
Safe
|
| Ecoa Search vendor "Ecoa" | Riskterminator Search vendor "Ecoa" for product "Riskterminator" | - | - |
Affected
| ||||||