Ecs Router Controller Ecs Firmware
CVE-2021-41295
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (cert) · only source for this CVE.
CVSS VectorVendor: cert
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands (GET, POST, PUT, DELETE) to perform arbitrary operations in the system.
AnalysisAI
ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands (GET, POST, PUT,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands (GET, POST, PUT, DELETE) to perform arbitrary operations in the system. Affected products include: Ecoa Ecs Router Controller-Ecs Firmware, Ecoa Riskbuster Firmware, Ecoa Riskterminator.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.
ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Rated high severity
ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Rated high severity (CVSS 7.5), this
ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files
ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can
ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers c
ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password at
ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Rated critical severity (CVSS
ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Rated critical severi
ECOA BAS controller suffers from an authentication bypass vulnerability. Rated critical severity (CVSS 9.1), this vulner
ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct a
ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate priv
ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today