CVE-2021-41294
📋 TL;DR
ECOA BAS controller has an unauthenticated path traversal vulnerability that allows remote attackers to delete arbitrary files via a specific GET parameter. This can lead to denial of service by deleting critical system files. All unpatched ECOA BAS controller installations are affected.
💻 Affected Systems
- ECOA BAS controller
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical operating system files, rendering the device permanently inoperable and disrupting building automation systems.
Likely Case
Denial of service by deleting configuration files or system binaries, causing the BAS controller to malfunction and requiring physical intervention to restore.
If Mitigated
Limited impact if network segmentation prevents external access and proper authentication controls are in place.
🎯 Exploit Status
Simple path traversal via GET parameter makes exploitation trivial for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in provided references
Vendor Advisory: https://www.twcert.org.tw/tw/cp-132-5130-7de92-1.html
Restart Required: Yes
Instructions:
1. Contact ECOA for patched firmware version. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Restart device. 5. Verify fix by testing path traversal.
🔧 Temporary Workarounds
Network Segmentation
allIsolate BAS controllers from untrusted networks and internet access
Web Application Firewall
allDeploy WAF with path traversal protection rules
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to BAS controllers
- Monitor for suspicious file deletion events and unusual web requests to controller interfaces
🔍 How to Verify
Check if Vulnerable:
Test by attempting path traversal via web interface with crafted GET parameters targeting non-critical test files.Check Version:
Check firmware version via web interface or console (vendor-specific command)Verify Fix Applied:
Attempt same path traversal tests after patching; successful deletion should no longer occur.📡 Detection & Monitoring
Log Indicators:
- Web server logs showing GET requests with suspicious path traversal patterns
- System logs showing unexpected file deletions
Network Indicators:
- HTTP requests to controller with ../ patterns in parameters
- Unusual file deletion operations over network
SIEM Query:
web.url:*../* AND (dst.port:80 OR dst.port:443) AND dst.ip:[CONTROLLER_IP]