Skip to content
OpenAdvisories
Critical · 9.8 CVE-2021-41296 EUVD-2021-28326GHSA-fwj3-rrm4-m35q

ECOA BAS controller - Weak Password Requirements

Published Sep 30, 2021 · Updated Sep 17, 2024 · Assigned by twcert

Description

ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.

Affected products

VendorProductAffectedFixed
ECOA ECS Router Controller ECS (FLASH) — —
ECOA RiskBuster Terminator E6L45 — —
ECOA RiskBuster System RB 3.0.0 — —
ECOA RiskBuster System TRANE 1.0 — —
ECOA Graphic Control Software — —
ECOA SmartHome II E9246 — —
ECOA RiskTerminator — —

References