Security Advisory

CVE-2022-37122

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2022-08-31 15:47:57

Last updated 2024-08-03 10:21:33

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

← Browse all CVEs View on cve.org ↗