CVE-2021-41293CWE-22

ECOA BAS controller - Path Traversal-3

High · published September 30, 2021

CVSS v3.1

7.5

EPSS

20%

Percentile

97.4

In the wild

Unconfirmed

What it is

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.19867 · 97.4th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2021-09-30T10:40Z

EPSS history

Timeline

30 SEP 10:40Z
ECOA BAS controller - Path Traversal-3
cvelistv5