CVE-2021-41292 — ECOA BAS controller - Broken Authentication
ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sen…
Published: 2021-09-30 · CVSS: 9.8 · CVSS 3.1
ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7