Administrator escalation via plaintext credentials

Credential exposure in ECOA BAS controllers allows remote authenticated users to gain administrator access through the user-edit page. The page renders administrator and user passwords in plaintext without restricting a general user's access to those credential values. A valid general-user account and network access to the controller are required; the exposed administrator credentials permit arbitrary administrative functions.