CVE-2021-41291: Improper Limitation of a Pathname to a Restricted Directory

ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device...

CVE-2021-41290: Unrestricted Upload of File with Dangerous Type

ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device...

PT-2021-23247

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is affected by a path traversal issue, which allows for the disclosure of arbitrary files. This can be exploited by unauthenticated attackers using a...

PT-2021-23252

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is vulnerable to insecure direct object references. This occurs when the application provides direct access to objects based on user-supplied input, allowi...

PT-2021-23248

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is affected by a path traversal issue, allowing unauthenticated attackers to delete arbitrary files on the device, potentially leading to a denial of servi...

PT-2021-23253

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The issue concerns hard-coded credentials within the Linux distribution image of the ECOA BAS controller. This allows remote attackers to obtain administrator privileges without...

PT-2021-23249

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller has a Cross-Site Request Forgery issue, allowing an authenticated attacker to remotely place a forged request at a malicious web page. This enables the...

PT-2021-23245

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is affected by a path traversal content disclosure issue. This allows unauthenticated attackers to remotely disclose directory content on the affected devi...

PT-2021-23256

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is susceptible to configuration disclosure through direct object reference when specific files are accessed using an HTTP GET request. This allows an...

PT-2021-23251

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The issue concerns a weak access control mechanism in the ECOA BAS controller, allowing an authenticated user to remotely escalate privileges. This is achieved by disclosing the...

PT-2021-23255

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller has a special page that displays user account and passwords in plain text. This allows unauthenticated attackers to access the page and obtain privileges...

CVE-2021-41302: Missing Encryption of Sensitive Data

ECOA BAS controller stores sensitive data backup exports in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege...

PT-2021-23257 · Unknown · Ecoa Bas Controller

Name of the Vulnerable Software and Affected Versions: ECOA BAS controller affected versions not specified Description: The ECOA BAS controller stores sensitive data, including backup exports, in clear-text. This allows an unauthenticated attacker to remotely query user passwords and obtain user...

Ecoa Bas controller security vulnerability

ECOA BAS controller is a building automation controller. ECOA BAS controller handles HTTP GET requests and is vulnerable to information disclosure, which can be exploited by remote attackers to submit ad hoc requests that can obtain sensitive information...

Ecoa Bas controller security vulnerability

Ecoa Bas controller is a building automation controller from Ecoa Technologies Corp in China. Ecoa Bas controller is vulnerable to an access control error, which can be exploited by attackers to compromise administrative account credentials in clear text to cause privilege escalation...

Ecoa Bas controller security vulnerability

ECOA BAS controller is an intelligent lighting control solution. an unauthorized access vulnerability exists in ECOA BAS controller, which can be exploited by remote attackers to bypass authorization to access hidden resources in the system and perform privileged functions...

Ecoa Bas controller path traversal vulnerability

Ecoa Bas controller is a building automation controller from Ecoa Technologies Corp. in China. A path traversal vulnerability exists in Ecoa Bas controller, which can be exploited by attackers to compromise the device directory content by using the GET parameter in the file manager...

Ecoa Bas controller trust management issue vulnerability

ECOA BAS controller is a BAS controller developed by Ecoa Technologies Corp in Taiwan, China. ECOA BAS controller is vulnerable to hard-coded credentials, which can be exploited by attackers to directly log in and gain administrator control privileges...

CVE-2021-41295: Cross-Site Request Forgery (CSRF)

ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands GET, POST, PUT, DELETE to perform arbitrary operations in the system...

CVE-2021-41296: Weak Password Requirements

ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system...