CVE-2021-41291
ECOA BAS controller - Path Traversal-1
CVE-2021-41291 is a high vulnerability (CVSS 7.5) in Ecoa Ecs Router Controller Ecs (flash), published September 30, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 82.7%, the 99th percentile. No source names a fixed version.
ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
ECOA BAS controller - Path Traversal-1
ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.
- Record
CVE-2021-41291- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2021-28321
ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.
- Record
EUVD-2021-28321- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9v2m-x295-3g46 No score
ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET...
ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.
- Record
GHSA-9v2m-x295-3g46- Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.
- Record
CVE-2021-41291- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | ECOA Building Automation System - Directory Traversal Content Disclosure |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, published | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, Nuclei, NVD |