.. / CVE-2021-41291

• Info Disclosure
• Nuclei
• Web

Exploit for ECOA Building Automation System - Directory Traversal Content Disclosure (CVE-2021-41291)

Description:

The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager (fmangersub), attackers can disclose directory content on the affected device

Nuclei Template

View the template here CVE-2021-41291.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-41291.yaml

References: