PT-2021-23252

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is vulnerable to insecure direct object references. This occurs when the application provides direct access to objects based on user-supplied input, allowi...

PT-2021-23246

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is affected by an authentication bypass issue. An unauthenticated attacker can exploit this by using cookie poisoning to remotely bypass authentication. Th...

PT-2021-23256

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is susceptible to configuration disclosure through direct object reference when specific files are accessed using an HTTP GET request. This allows an...

Ecoa Bas controller 安全漏洞

ECOA BAS controller is a building automation controller. ECOA BAS controller handles HTTP GET requests and is vulnerable to information disclosure, which can be exploited by remote attackers to submit ad hoc requests that can obtain sensitive information...

Ecoa Bas controller 安全漏洞

Ecoa Bas controller is a building automation controller from Ecoa Technologies Corp in China. Ecoa Bas controller is vulnerable to an access control error, which can be exploited by attackers to compromise administrative account credentials in clear text to cause privilege escalation...

Ecoa Bas controller 信任管理问题漏洞

ECOA BAS controller is a BAS controller developed by Ecoa Technologies Corp in Taiwan, China. ECOA BAS controller is vulnerable to hard-coded credentials, which can be exploited by attackers to directly log in and gain administrator control privileges...

Ecoa Bas controller 安全漏洞

ECOA BAS controller is an intelligent lighting control solution. an unauthorized access vulnerability exists in ECOA BAS controller, which can be exploited by remote attackers to bypass authorization to access hidden resources in the system and perform privileged functions...

Ecoa Bas controller 路径遍历漏洞

Ecoa Bas controller is a building automation controller from Ecoa Technologies Corp. in China. A path traversal vulnerability exists in Ecoa Bas controller, which can be exploited by attackers to compromise the device directory content by using the GET parameter in the file manager...

CVE-2021-41295: Cross-Site Request Forgery (CSRF)

ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands GET, POST, PUT, DELETE to perform arbitrary operations in the system...

CVE-2021-41292: Authentication Bypass Using an Alternate Path or Channel

ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC...

CVE-2021-41301: Exposure of Sensitive Information to an Unauthorized Actor

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation...

CVE-2021-41302: Missing Encryption of Sensitive Data

ECOA BAS controller stores sensitive data backup exports in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege...

CVE-2021-41297: Insufficiently Protected Credentials

ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts in plain-text...

CVE-2021-41300: Insufficiently Protected Credentials

ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionality...

PT-2021-23255

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller has a special page that displays user account and passwords in plain text. This allows unauthenticated attackers to access the page and obtain privileges...

PT-2021-23253

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The issue concerns hard-coded credentials within the Linux distribution image of the ECOA BAS controller. This allows remote attackers to obtain administrator privileges without...