CVE-2021-41290: ECOA ECS Router Controller ECS (FLASH), качване на

Описание

Оригинално описание

ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.

Засегнати продукти

• ECOA ECS Router Controller ECS (FLASH): next of 0 преди unspecified
• ECOA RiskBuster Terminator E6L45: next of 0 преди unspecified
• ECOA RiskBuster System RB 3.0.0: next of 0 преди unspecified
• ECOA RiskBuster System TRANE 1.0: next of 0 преди unspecified
• ECOA Graphic Control Software: next of 0 преди unspecified
• ECOA SmartHome II E9246: next of 0 преди unspecified
• ECOA RiskTerminator: next of 0 преди unspecified

Вид слабост

• CWE-434 Неограничено качване на файл от опасен тип

История

Други уязвимости в ECOA ECS Router Controller ECS (FLASH)

• 7.3CVE-2021-41302
• 9.8CVE-2021-41301
• 9.8CVE-2021-41300
• 9.8CVE-2021-41299
• 8.8CVE-2021-41298

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-41290
• https://nvd.nist.gov/vuln/detail/CVE-2021-41290
• https://www.twcert.org.tw/tw/cp-132-5126-ca315-1.html