Description (CNA)
ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ECOA / ECS Router Controller ECS (FLASH) | unknown next of 0 before unspecified |
| ECOA / RiskBuster Terminator E6L45 | unknown next of 0 before unspecified |
| ECOA / RiskBuster System RB 3.0.0 | unknown next of 0 before unspecified |
| ECOA / RiskBuster System TRANE 1.0 | unknown next of 0 before unspecified |
| ECOA / Graphic Control Software | unknown next of 0 before unspecified |
| ECOA / SmartHome II E9246 | unknown next of 0 before unspecified |
| ECOA / RiskTerminator | unknown next of 0 before unspecified |
CWE
CWE-200
References
ADP enrichment
No English description supplied.