CVEvulnerability

CVE-2022-37122

7.5 HIGH Published 2022-08-31 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-08-31
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22

Description

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

Affected configurations

• carel pcoweb card firmware (>= a2.1.0 <= b.2.1.0) • carel applica 2.154a • carel applica 16 13020200 • carel pcoweb hvac bacnet gateway 2.1.0

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References