Описание
ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.
Ссылки
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1
Одновременно
cpe:2.3:o:ecoa:ecs_router_controller-ecs_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:ecoa:ecs_router_controller-ecs:*:*:*:*:*:*:*:*
Конфигурация 2
Одновременно
cpe:2.3:o:ecoa:riskbuster_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:ecoa:riskbuster:*:*:*:*:*:*:*:*
Конфигурация 3
cpe:2.3:a:ecoa:riskterminator:-:*:*:*:*:*:*:*
EPSS
Процентиль: 62%
0.0043
Низкий
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-200
CWE-639
Связанные уязвимости
github
больше 3 лет назад
ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.
EPSS
Процентиль: 62%
0.0043
Низкий
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
CWE-200
CWE-639