1. Home
  2. CVE Database
  3. CVE-2021-41293
HIGH · 7.5

CVE-2021-41293

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files ...

Vulnerability Description

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
EcoaEcs Router Controller-Ecs Firmware-
EcoaEcs Router Controller-Ecs-
EcoaRiskbuster Firmware-
EcoaRiskbuster-
EcoaRiskterminator-

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2021-41293?

CVE-2021-41293 is a vulnerability with a CVSS score of 7.5 (HIGH). ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files ...

How severe is CVE-2021-41293?

CVE-2021-41293 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-41293?

Check the references section above for vendor advisories and patch information. Affected products include: Ecoa Ecs Router Controller-Ecs Firmware, Ecoa Ecs Router Controller-Ecs, Ecoa Riskbuster Firmware, Ecoa Riskbuster, Ecoa Riskterminator.