Ecoa
Ecoa's vulnerability profile centers on a narrow portfolio of network routing and security appliances, particularly its ECS Router Controller product line and related firmware, which occupy a prominent role in critical infrastructure and enterprise network architectures. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code; the exposure recurs through authorization and authentication weaknesses—including path traversal, credential-handling flaws, and alternate-channel bypass mechanisms—that are characteristic of embedded network appliances handling privileged access control. Defenders should prioritize this vendor's advisories and treat exposed routing infrastructure as a high-urgency patching target; current severity, exploitation activity, and exposure counts are shown alongside this summary.
Trends Over Time
The number and severity of CVEs published that impact products developed by Ecoa over time
Products(5 total)
Top CVEs
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-41291HIGH ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directo | Sep 30, 2021 | 7.5 | 77 | NO | YES |
CVE-2021-41293HIGH ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely discl | Sep 30, 2021 | 7.5 | 44 | NO | YES |
CVE-2021-41300CRITICAL ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionalit | Sep 30, 2021 | 9.8 | 31 | NO | NO |
CVE-2021-41299CRITICAL ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege without logging in. | Sep 30, 2021 | 9.8 | 30 | NO | NO |
CVE-2021-41290CRITICAL ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values fo | Sep 30, 2021 | 9.8 | 30 | NO | NO |
CVE-2021-41301CRITICAL ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthentic | Sep 30, 2021 | 9.8 | 29 | NO | NO |
CVE-2021-41296CRITICAL ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system. | Sep 30, 2021 | 9.8 | 29 | NO | NO |
CVE-2021-41297HIGH ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts | Sep 30, 2021 | 8.8 | 27 | NO | NO |
CVE-2021-41294CRITICAL ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete a | Sep 30, 2021 | 9.1 | 27 | NO | NO |
CVE-2021-41292CRITICAL ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensit | Sep 30, 2021 | 9.1 | 27 | NO | NO |
CVE Severity & Scoring
Exploit Exposure
Signals from CVEs in this vendor scope (13 CVEs).
Social Chatter
An overview of all social media posts that mention a CVE ID that affects a product developed by Ecoa.
Media Mentions
Media articles that mention a CVE ID that affects a product developed by Ecoa — matched by CVE ID, not by vendor name.