Critical · published September 30, 2021
🚨 A sneaky path traversal vulnerability lets attackers delete any file on your ECOA BAS controller without breaking a sweat! 🔥 Think of it like a delivery driver who, instead of just dropping off packages, can walk straight into your office and toss out anything they want without anyone stopping them. This could lead to critical files being deleted, potentially crippling your BAS system and causing a complete denial of service! Imagine losing essential configurations and operational data, leaving your building management in total chaos.
Think of it like a delivery driver who, instead of just dropping off packages, can walk straight into your office and toss out anything they want without anyone stopping them. The vulnerability arises from a flaw in the GET parameter handling, allowing unauthenticated attackers to exploit path traversal and remotely delete arbitrary files on the device.
This could lead to critical files being deleted, potentially crippling your BAS system and causing a complete denial of service! Imagine losing essential configurations and operational data, leaving your building management in total chaos. It's crucial to patch your ECOA BAS controller immediately to the latest version. Additionally, implement strict input validation to ensure that unauthorized file paths cannot be accessed. Don't wait on this one! You've got this! With these steps, you can secure your system and keep it running smoothly. 🛡️