Back
CVE-2021-41292
ECOA BAS controller - Broken Authentication
Critical9.8EPSS 1.2%
- Published
- Updated
- Reserved
- Assigned by
- twcert
Description
ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| twcertCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 1.2% · top 32% of all CVEs (7 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
Affected products
ECOA · ECS Router Controller ECS (FLASH)
- unknown next of 0 – < unspecified
ECOA · RiskBuster Terminator E6L45
- unknown next of 0 – < unspecified
ECOA · RiskBuster System RB 3.0.0
- unknown next of 0 – < unspecified
ECOA · RiskBuster System TRANE 1.0
- unknown next of 0 – < unspecified
ECOA · Graphic Control Software
- unknown next of 0 – < unspecified
- unknown next of 0 – < unspecified
- unknown next of 0 – < unspecified
What to do
Solution: Contact tech support from ECOA.
References (1)
- https://www.twcert.org.tw/tw/cp-132-5128-b075a-1.html (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2021-41292)Record last updated .