{"id":"CVE-2021-41301","aliases":["EUVD-2021-28331","GHSA-2qv4-869g-77jr"],"status":"published","title":"ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor","description":"ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01989,"percentile":0.80805,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200","CWE-639"],"published":"2021-09-30T10:41:06Z","modified":"2026-06-17T04:08:16Z","products":[{"vendor":"ecoa","product":"ecs router controller ecs (flash)"},{"vendor":"ecoa","product":"ecs_router_controller-ecs_firmware"},{"vendor":"ecoa","product":"graphic control software"},{"vendor":"ecoa","product":"riskbuster system rb 3.0.0"},{"vendor":"ecoa","product":"riskbuster system trane 1.0"},{"vendor":"ecoa","product":"riskbuster terminator e6l45"},{"vendor":"ecoa","product":"riskbuster_firmware"},{"vendor":"ecoa","product":"riskterminator"},{"vendor":"ecoa","product":"smarthome ii e9246"}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-5137-730a6-1.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41301"},{"url":"https://github.com/advisories/GHSA-2qv4-869g-77jr"}],"sources":{"cve":[{"id":"CVE-2021-41301","title":"ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor","description":"ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.","status":"published","published":"2021-09-30T10:41:06.633Z","modified":"2024-09-16T16:53:19.967Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-28331","description":"ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.","status":"published","published":"2021-09-30T10:41:06Z","modified":"2024-09-16T16:53:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:47.18954Z"}],"ghsa":[{"id":"GHSA-2qv4-869g-77jr","title":"ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is...","description":"ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.","status":"published","published":"2022-05-24T19:16:13Z","modified":"2023-01-30T05:02:23Z","cwes":["CWE-639"],"updated_at":"2026-11-02T14:46:37.595676Z"}],"nvd":[{"id":"CVE-2021-41301","description":"ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.","status":"published","published":"2021-09-30T11:15:07.977Z","modified":"2026-06-17T04:08:16.203Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-200","CWE-639"],"updated_at":"2026-11-02T14:06:59.314106Z"}]}}