Description
ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ECOA | ECS Router Controller ECS (FLASH) | — | — |
| ECOA | RiskBuster Terminator E6L45 | — | — |
| ECOA | RiskBuster System RB 3.0.0 | — | — |
| ECOA | RiskBuster System TRANE 1.0 | — | — |
| ECOA | Graphic Control Software | — | — |
| ECOA | SmartHome II E9246 | — | — |
| ECOA | RiskTerminator | — | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- ECOA Building Automation System - Arbitrary File Retrieval http/cves/2021/CVE-2021-41293.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.