Ecs Router Controller Ecs Firmware
Vendor:
First CVE: Sep 30, 2021 · Active for 4 years
13
Total CVEs
More Total CVEs than 92% of tracked products
13.0
Avg CVEs / Year
Higher CVE frequency than 97% of tracked products
8.9
Avg CVSS
Higher Avg CVSS than 83% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Ecs Router Controller Ecs Firmware over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 30, 2021
4 years ago
Most Recent CVE
Sep 30, 2021
1,762 days ago
CVE Severity & Scoring
Ecs Router Controller Ecs Firmware13 CVEs
46%
54%
All CVEs353,173 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local0 (0.0%)
Network13 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low13 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None12 (92.3%)
Unknown0 (0.0%)
Required1 (7.7%)
Privileges Required
Low2 (15.4%)
High0 (0.0%)
None11 (84.6%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-41291HIGH ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directo | Sep 30, 2021 | 7.5 | 77 | NO | YES |
CVE-2021-41293HIGH ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely discl | Sep 30, 2021 | 7.5 | 44 | NO | YES |
CVE-2021-41300CRITICAL ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionalit | Sep 30, 2021 | 9.8 | 31 | NO | NO |
CVE-2021-41299CRITICAL ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege without logging in. | Sep 30, 2021 | 9.8 | 30 | NO | NO |
CVE-2021-41290CRITICAL ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values fo | Sep 30, 2021 | 9.8 | 30 | NO | NO |
CVE-2021-41301CRITICAL ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthentic | Sep 30, 2021 | 9.8 | 29 | NO | NO |
CVE-2021-41296CRITICAL ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system. | Sep 30, 2021 | 9.8 | 29 | NO | NO |
CVE-2021-41297HIGH ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts | Sep 30, 2021 | 8.8 | 27 | NO | NO |
CVE-2021-41294CRITICAL ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete a | Sep 30, 2021 | 9.1 | 27 | NO | NO |
CVE-2021-41292CRITICAL ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensit | Sep 30, 2021 | 9.1 | 27 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (13 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
2 CVEs
15.4% of CVEs· 98th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (13 CVEs).
Media Mentions
Signals from CVEs in this product scope (13 CVEs).
Top CNAs Publishing CVEs For Ecs Router Controller Ecs Firmware
Top CWEs
Versions
No cataloged versions.