CVE-2021-41299: ECOA ECS Router Controller ECS (FLASH), заобикаляне на

Описание

Оригинално описание

ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege without logging in.

Засегнати продукти

• ECOA ECS Router Controller ECS (FLASH): next of 0 преди unspecified
• ECOA RiskBuster Terminator E6L45: next of 0 преди unspecified
• ECOA RiskBuster System RB 3.0.0: next of 0 преди unspecified
• ECOA RiskBuster System TRANE 1.0: next of 0 преди unspecified
• ECOA Graphic Control Software: next of 0 преди unspecified
• ECOA SmartHome II E9246: next of 0 преди unspecified
• ECOA RiskTerminator: next of 0 преди unspecified

Вид слабост

• CWE-798 Use of Hard-coded Credentials

История

Други уязвимости в ECOA ECS Router Controller ECS (FLASH)

• 7.3CVE-2021-41302
• 9.8CVE-2021-41301
• 9.8CVE-2021-41300
• 8.8CVE-2021-41298
• 8.8CVE-2021-41297

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-41299
• https://nvd.nist.gov/vuln/detail/CVE-2021-41299
• https://www.twcert.org.tw/tw/cp-132-5135-a9f5c-1.html