Description
ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ECOA | ECS Router Controller ECS (FLASH) | — | — |
| ECOA | RiskBuster Terminator E6L45 | — | — |
| ECOA | RiskBuster System RB 3.0.0 | — | — |
| ECOA | RiskBuster System TRANE 1.0 | — | — |
| ECOA | Graphic Control Software | — | — |
| ECOA | SmartHome II E9246 | — | — |
| ECOA | RiskTerminator | — | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- ECOA Building Automation System - Directory Traversal Content Disclosure http/cves/2021/CVE-2021-41291.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.