PT-2021-23255

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller has a special page that displays user account and passwords in plain text. This allows unauthenticated attackers to access the page and obtain privileges...

PT-2021-23246

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is affected by an authentication bypass issue. An unauthenticated attacker can exploit this by using cookie poisoning to remotely bypass authentication. Th...

PT-2021-23250

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The issue concerns the use of a weak set of default administrative credentials in the ECOA BAS controller. These credentials can be easily guessed, allowing attackers to gain full...

Ecoa Bas controller 安全漏洞

ECOA BAS controller is an intelligent lighting control solution. an unauthorized access vulnerability exists in ECOA BAS controller, which can be exploited by remote attackers to bypass authorization to access hidden resources in the system and perform privileged functions...

PT-2021-23252

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is vulnerable to insecure direct object references. This occurs when the application provides direct access to objects based on user-supplied input, allowi...

CVE-2021-41298: Improper Access Control

ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden...

Ecoa Bas controller 信任管理问题漏洞

ECOA BAS controller is a BAS controller developed by Ecoa Technologies Corp in Taiwan, China. ECOA BAS controller is vulnerable to hard-coded credentials, which can be exploited by attackers to directly log in and gain administrator control privileges...

PT-2021-23253

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The issue concerns hard-coded credentials within the Linux distribution image of the ECOA BAS controller. This allows remote attackers to obtain administrator privileges without...

Ecoa Bas controller 路径遍历漏洞

Ecoa Bas controller is a building automation controller from Ecoa Technologies Corp. in China. A path traversal vulnerability exists in Ecoa Bas controller, which can be exploited by attackers to compromise the device directory content by using the GET parameter in the file manager...

PT-2021-23249

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller has a Cross-Site Request Forgery issue, allowing an authenticated attacker to remotely place a forged request at a malicious web page. This enables the...

CVE-2021-41302: Missing Encryption of Sensitive Data

ECOA BAS controller stores sensitive data backup exports in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege...

Ecoa Bas controller 安全漏洞

ECOA BAS controller is a building automation controller. ECOA BAS controller handles HTTP GET requests and is vulnerable to information disclosure, which can be exploited by remote attackers to submit ad hoc requests that can obtain sensitive information...

CVE-2021-41299: Use of Hard-coded Credentials

ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege without logging in...

PT-2021-23256

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is susceptible to configuration disclosure through direct object reference when specific files are accessed using an HTTP GET request. This allows an...

CVE-2021-41301: Exposure of Sensitive Information to an Unauthorized Actor

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation...

CVE-2021-41300: Insufficiently Protected Credentials

ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionality...

PT-2021-23248

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is affected by a path traversal issue, allowing unauthenticated attackers to delete arbitrary files on the device, potentially leading to a denial of servi...

CVE-2021-41295: Cross-Site Request Forgery (CSRF)

ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands GET, POST, PUT, DELETE to perform arbitrary operations in the system...

PT-2021-23244 · Unknown · Ecoa Bas Controller

Name of the Vulnerable Software and Affected Versions: ECOA BAS controller affected versions not specified Description: The ECOA BAS controller is affected by an arbitrary file write and path traversal issue. Unauthenticated attackers can exploit this by using POST parameters to set arbitrary...

CVE-2021-41290: Unrestricted Upload of File with Dangerous Type

ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device...