CVE-2021-41301: ECOA ECS Router Controller ECS (FLASH), изтичане на

Описание

Оригинално описание

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

Засегнати продукти

• ECOA ECS Router Controller ECS (FLASH): next of 0 преди unspecified
• ECOA RiskBuster Terminator E6L45: next of 0 преди unspecified
• ECOA RiskBuster System RB 3.0.0: next of 0 преди unspecified
• ECOA RiskBuster System TRANE 1.0: next of 0 преди unspecified
• ECOA Graphic Control Software: next of 0 преди unspecified
• ECOA SmartHome II E9246: next of 0 преди unspecified
• ECOA RiskTerminator: next of 0 преди unspecified

Вид слабост

• CWE-200 Разкриване на чувствителна информация пред неоторизирана страна

История

Други уязвимости в ECOA ECS Router Controller ECS (FLASH)

• 7.3CVE-2021-41302
• 9.8CVE-2021-41300
• 9.8CVE-2021-41299
• 8.8CVE-2021-41298
• 8.8CVE-2021-41297

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-41301
• https://nvd.nist.gov/vuln/detail/CVE-2021-41301
• https://www.twcert.org.tw/tw/cp-132-5137-730a6-1.html