CVE:CVE-2021-41295
CNNVD:CNNVD-202109-1966
Ecoa Technologies Corp Ecoa Bas controller是中国Ecoa Technologies Corp公司的一个楼宇自动化控制器。
Ecoa Bas controller存在跨站请求伪造漏洞，经过身份验证的攻击者可以远程向恶意网页发送伪造请求，并执行 CRUD 命令（GET、POST、PUT、DELETE）在系统中执行任意操作。
solution:Upgrade ecoa ecs_router_controller-ecs_firmware to a higher version than -; Upgrade ecoa riskbuster_firmware to a higher version than -; Upgrade ecoa riskterminator to a higher version than -