← Database

CVE-2021-41290

CRITICAL CVSS: 9.8 Published: 2021-09-30 Modified: 2026-06-17

Description

ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.

Affected Platforms

Ecoa Ecs Router Controller-EcsEcoa RiskbusterEcoa Riskbuster FirmwareEcoa Ecs Router Controller-Ecs FirmwareEcoa Riskterminator

Weakness Type

CWE-434, CWE-22

References