PT-2021-23249 · Unknown · Ecoa Bas Controller

Gjoko Krstic · Published 2021-09-30 · Updated 2021-10-07 · CVE-2021-41295

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ECOA BAS controller (affected versions not specified)

Description The ECOA BAS controller has a Cross-Site Request Forgery issue, allowing an authenticated attacker to remotely place a forged request at a malicious web page. This enables the execution of CRUD commands, including GET, POST, PUT, and DELETE, to perform arbitrary operations in the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-41295

Affected Products

Ecoa Bas Controller

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-41295 · Security Note
• https://twcert.org.tw/tw/cp-132-5131-c653b-1.html · Note
• https://t.me/cibsecurity/29702 · Telegram Post