{"id":"CVE-2021-41292","aliases":["EUVD-2021-28322","GHSA-wf48-98rg-498v"],"status":"published","title":"ECOA BAS controller - Broken Authentication","description":"ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01172,"percentile":0.67851,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287","CWE-288"],"published":"2021-09-30T10:40:52Z","modified":"2026-06-17T04:08:15Z","products":[{"vendor":"ecoa","product":"ecs router controller ecs (flash)"},{"vendor":"ecoa","product":"ecs_router_controller-ecs_firmware"},{"vendor":"ecoa","product":"graphic control software"},{"vendor":"ecoa","product":"riskbuster system rb 3.0.0"},{"vendor":"ecoa","product":"riskbuster system trane 1.0"},{"vendor":"ecoa","product":"riskbuster terminator e6l45"},{"vendor":"ecoa","product":"riskbuster_firmware"},{"vendor":"ecoa","product":"riskterminator"},{"vendor":"ecoa","product":"smarthome ii e9246"}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-5128-b075a-1.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41292"},{"url":"https://github.com/advisories/GHSA-wf48-98rg-498v"}],"sources":{"cve":[{"id":"CVE-2021-41292","title":"ECOA BAS controller - Broken Authentication","description":"ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.","status":"published","published":"2021-09-30T10:40:52.625Z","modified":"2024-09-17T03:32:30.239Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-28322","description":"ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.","status":"published","published":"2021-09-30T10:40:52Z","modified":"2024-09-17T03:32:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:28:31.175316Z"}],"ghsa":[{"id":"GHSA-wf48-98rg-498v","title":"ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated...","description":"ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.","status":"published","published":"2022-05-24T19:16:13Z","modified":"2023-01-30T05:02:32Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287","CWE-288"],"updated_at":"2026-11-02T14:46:39.888016Z"}],"nvd":[{"id":"CVE-2021-41292","description":"ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.","status":"published","published":"2021-09-30T11:15:07.477Z","modified":"2026-06-17T04:08:15.11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-288","CWE-287"],"updated_at":"2026-11-02T14:06:59.314106Z"}]}}