title: ECOA BAS controller - Path Traversal-3
description: ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
product: ECS Router Controller ECS (FLASH)
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: RiskBuster Terminator E6L45
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: RiskBuster System RB 3.0.0
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: RiskBuster System TRANE 1.0
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: Graphic Control Software
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: SmartHome II E9246
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
{
product: RiskTerminator
vendor: ECOA
versions:
lessThan: unspecified, status: unknown, version: next of 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: Contact tech support from ECOA.