CVE-2021-41290

Katalog CVE

CVSS 9.8 · Critical EPSS 2,3%

Kerentanan Unrestricted Upload of File with Dangerous Type pada ecoa ecs router controller-ecs firmware, ecoa riskbuster firmware +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut cert.org.tw.

Deskripsi (NVD)

ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.

Rincian

Terbit di NVD

30 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber cert.org.tw
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 83,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.twcert.org.tw/tw/cp-132-5126-ca315-1.html advisory pihak ketiga