CVE-2021-41296
9.8 CRITICALECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain fu...
Published: 2021-09-30 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 9.8 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-521
Affected products
| Vendor | Product |
|---|---|
| ecoa | ecs_router_controller-ecs_firmware, riskbuster_firmware, riskterminator |
Description
ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
Source: NVD
References
Related CVEs
Same vendor
- CVE-2021-41302 — ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user passw... (7.3 HIGH)
- CVE-2021-41301 — ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GE... (9.8 CRITICAL)
- CVE-2021-41300 — ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page ... (9.8 CRITICAL)
- CVE-2021-41299 — ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain adminis... (9.8 CRITICAL)
- CVE-2021-41298 — ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects ... (8.8 HIGH)
Same CWE
- CVE-2026-11493 — A weakness has been identified in Tenda AC15 15.03.05.19 (5.0 MEDIUM)
- CVE-2024-40684 — IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3... (5.9 MEDIUM)
- CVE-2026-9394 — A vulnerability was determined in Besen BS20 EV Charging Station up to 20260426 (3.1 LOW)
- CVE-2021-38462 — InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy (9.8 CRITICAL)
- CVE-2017-7903 — A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 176... (9.8 CRITICAL)