CVE-2021-41298

Katalog CVE

CVSS 8.8 · High EPSS 0,87%

Kerentanan Improper Access Control pada ecoa ecs router controller-ecs firmware, ecoa riskbuster firmware +1 lainnya. Skor CVSS 3.1 8.8 (High) menurut cert.org.tw.

Deskripsi (NVD)

ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privilege can remotely bypass authorization and access the hidden resources in the system and execute privileged functionalities.

Rincian

Terbit di NVD

30 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber cert.org.tw
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,87% peluang dieksploitasi; lebih tinggi dari 57,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.twcert.org.tw/tw/cp-132-5134-39f74-1.html advisory pihak ketiga