Security
Headlines
HeadlinesLatestCVEs

Source

Zero Science Lab

ECOA Building Automation System Configuration Download Information Disclosure

The BAS controller is vulnerable to configuration disclosure when direct object reference is made to the syspara.dat or images.dat files using an HTTP GET request. This will enable the attacker to disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

Zero Science Lab
ECOA Building Automation System Cross-Site Request Forgery

The Building Automation System / SmartHome allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. These actions can be exploited to perform any CRUD operation like user creation, alarm shutdown and account password change with administrative privileges if a logged-in user visits a malicious web site.