title: ECOA BAS controller - Path Traversal-1
description: ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
product: ECS Router Controller ECS (FLASH)
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: RiskBuster Terminator E6L45
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: RiskBuster System RB 3.0.0
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: RiskBuster System TRANE 1.0
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: Graphic Control Software
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: SmartHome II E9246
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: RiskTerminator
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Contact tech support from ECOA.