CVE-2021-41302
ECOA BAS controller - Missing Encryption of Sensitive Data
Severity Score
7.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege.
El controlador ECOA BAS almacena datos confidenciales (exportaciones de copias de seguridad) en texto sin cifrar, por lo que un atacante no autenticado puede consultar remotamente la contraseña del usuario y alcanzar sus privilegios
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-09-15 CVE Reserved
- 2021-09-30 CVE Published
- 2024-09-16 CVE Updated
- 2024-12-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-311: Missing Encryption of Sensitive Data
- CWE-312: Cleartext Storage of Sensitive Information
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://www.twcert.org.tw/tw/cp-132-5138-d40ae-1.html | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ecoa Search vendor "Ecoa" | Ecs Router Controller-ecs Firmware Search vendor "Ecoa" for product "Ecs Router Controller-ecs Firmware" | - | - |
Affected
| in | Ecoa Search vendor "Ecoa" | Ecs Router Controller-ecs Search vendor "Ecoa" for product "Ecs Router Controller-ecs" | - | - |
Safe
|
| Ecoa Search vendor "Ecoa" | Riskbuster Firmware Search vendor "Ecoa" for product "Riskbuster Firmware" | - | - |
Affected
| in | Ecoa Search vendor "Ecoa" | Riskbuster Search vendor "Ecoa" for product "Riskbuster" | - | - |
Safe
|
| Ecoa Search vendor "Ecoa" | Riskterminator Search vendor "Ecoa" for product "Riskterminator" | - | - |
Affected
| ||||||