CVE-2021-41302
30.09.2021, 11:15
ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain users privilege.Enginsight
| Vendor | Product | Version |
|---|---|---|
| ecoa | ecs_router_controller-ecs_firmware | - |
| ecoa | riskbuster_firmware | - |
| ecoa | riskterminator | - |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-311 - Missing Encryption of Sensitive DataThe software does not encrypt sensitive or critical information before storage or transmission.
- CWE-312 - Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.