Lucene search

[email protected]NVD:CVE-2021-41301

HistorySep 30, 2021 - 11:15 a.m.

CVE-2021-41301

2021-09-3011:15:07

CWE-639

CWE-200

[email protected]

web.nvd.nist.gov

vulnerability

ecoa bas controller

http

get request

configuration disclosure

unauthenticated attacker

sensitive information

authentication bypass

privilege escalation

system access

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

69.2%

JSON

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

Affected configurations

Nvd

Node

ecoaecs_router_controller-ecs_firmwareMatch-

AND

ecoaecs_router_controller-ecs

Node

ecoariskbuster_firmwareMatch-

AND

ecoariskbuster

Node

ecoariskterminatorMatch-

References

www.twcert.org.tw/tw/cp-132-5137-730a6-1.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

69.2%

JSON

Related for NVD:CVE-2021-41301

prion1 zeroscience1 cnvd1 cvelist1 cve1