CVE-2021-41294
ECOA BAS controller - Path Traversal-4
Severity Score
9.1
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario.
El controlador ECOA BAS sufre una vulnerabilidad de salto de ruta, causando el borrado arbitrario de archivos. usando el parámetro GET específico, unos atacantes no autenticados pueden eliminar remotamente archivos arbitrarios en el dispositivo afectado y causar un escenario de denegación de servicio
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-09-15 CVE Reserved
- 2021-09-30 CVE Published
- 2024-09-17 CVE Updated
- 2024-12-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://www.twcert.org.tw/tw/cp-132-5130-7de92-1.html | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ecoa Search vendor "Ecoa" | Ecs Router Controller-ecs Firmware Search vendor "Ecoa" for product "Ecs Router Controller-ecs Firmware" | - | - |
Affected
| in | Ecoa Search vendor "Ecoa" | Ecs Router Controller-ecs Search vendor "Ecoa" for product "Ecs Router Controller-ecs" | - | - |
Safe
|
| Ecoa Search vendor "Ecoa" | Riskbuster Firmware Search vendor "Ecoa" for product "Riskbuster Firmware" | - | - |
Affected
| in | Ecoa Search vendor "Ecoa" | Riskbuster Search vendor "Ecoa" for product "Riskbuster" | - | - |
Safe
|
| Ecoa Search vendor "Ecoa" | Riskterminator Search vendor "Ecoa" for product "Riskterminator" | - | - |
Affected
| ||||||