Vulnerability · Published Sep 30, 2021 · Assigned by twcert

CVE-2021-41298ECOA BAS controller - Improper Access Control

High 8.8

In plain English

A high-severity improper access control in ECS Router Controller ECS (FLASH) from ECOA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.9%top 41.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.

Affected products (as reported)

Vendor	Product	Versions
ECOA	ECS Router Controller ECS (FLASH)	see references
ECOA	RiskBuster Terminator E6L45	see references
ECOA	RiskBuster System RB 3.0.0	see references
ECOA	RiskBuster System TRANE 1.0	see references
ECOA	Graphic Control Software	see references
ECOA	SmartHome II E9246	see references
ECOA	RiskTerminator	see references

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://www.twcert.org.tw/tw/cp-132-5134-39f74-1.html x_refsource_MISC