CVE-2021-41290: Ecoa Ecs Router Controller-Ecs Firmware

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code on the affected device.

Affected products

• Ecoa Ecs Router Controller-Ecs Firmware: affected versions not specified
• Ecoa Riskbuster Firmware: affected versions not specified
• Ecoa Riskterminator: affected versions not specified

Published 2021-09-30. Last modified 2026-06-17.