CVE-2021-41291CWE-22

ECOA BAS controller - Path Traversal-1

High · published September 30, 2021

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.7th percentile for exploit probability.

CVSS v3.1

7.5

EPSS

83%

Percentile

99.7

In the wild

Unconfirmed

What it is

ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.82689 · 99.7th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2021-09-30T10:40Z

EPSS history

Timeline

30 SEP 10:40Z
ECOA BAS controller - Path Traversal-1
cvelistv5