Headline
ECOA Building Automation System Cookie Poisoning Authentication Bypass
The BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.
Related news
CVE-2021-41292: TWCERT/CC台灣電腦網路危機處理暨協調中心-ECOA BAS controller - Broken Authentication
ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buildings and manipulate HVAC.
CVE-2021-35943: Alerts | Couchbase
Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented from using an empty password, per RFC4513.