CVE-2021-41298: ECOA ECS Router Controller ECS (FLASH), заобикаляне на

Описание

Оригинално описание

ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.

Засегнати продукти

• ECOA ECS Router Controller ECS (FLASH): next of 0 преди unspecified
• ECOA RiskBuster Terminator E6L45: next of 0 преди unspecified
• ECOA RiskBuster System RB 3.0.0: next of 0 преди unspecified
• ECOA RiskBuster System TRANE 1.0: next of 0 преди unspecified
• ECOA Graphic Control Software: next of 0 преди unspecified
• ECOA SmartHome II E9246: next of 0 преди unspecified
• ECOA RiskTerminator: next of 0 преди unspecified

Вид слабост

• CWE-284 Неправилен контрол на достъпа

История

Други уязвимости в ECOA ECS Router Controller ECS (FLASH)

• 7.3CVE-2021-41302
• 9.8CVE-2021-41301
• 9.8CVE-2021-41300
• 9.8CVE-2021-41299
• 8.8CVE-2021-41297

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-41298
• https://nvd.nist.gov/vuln/detail/CVE-2021-41298
• https://www.twcert.org.tw/tw/cp-132-5134-39f74-1.html