CVE-2022-37122

🗓️ 31 Aug 2022 15:47:57Reported by mitreType

cve

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 49 Views🌐 WEB

Carel pCOWeb HVAC BACnet Gateway 2.1.0 suffers from unauthenticated arbitrary file disclosure vulnerabilit

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Path Traversal in Carel Pcoweb_Card_Firmware	12 Oct 202502:01	–	githubexploit
ATTACKERKB	CVE-2022-37122	31 Aug 202216:15	–	attackerkb
Circl	CVE-2022-37122	31 Aug 202220:43	–	circl
CNNVD	Carel pCOWeb HVAC BACnet Gateway 路径遍历漏洞	31 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-37122	31 Aug 202215:47	–	cvelist
EUVD	EUVD-2022-39775	31 Aug 202215:47	–	euvd
Nuclei	Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal	6 Jun 202603:01	–	nuclei
NVD	CVE-2022-37122	31 Aug 202216:15	–	nvd
Prion	Directory traversal	31 Aug 202216:15	–	prion
Positive Technologies	PT-2022-23822	31 Aug 202200:00	–	ptsecurity

NVD

Node

carel pcoweb_card_firmwareRangea2.1.0–b.2.1.0

AND

carel pcoweb_cardMatch-

Node

carel applicaMatch2.154a

OR

carel applicaMatch16_13020200

OR

carel pcoweb_hvac_bacnet_gatewayMatch2.1.0

Source	Link
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php
zeroscience	www.zeroscience.mk/codes/carelpco_dir.txt
packetstormsecurity	www.packetstormsecurity.com/files/167684/

Parameter	Position	Path	Description	CWE
file	query param	/usr-cgi/logdownload.cgi	Unauthenticated arbitrary file disclosure via directory traversal through logdownload.cgi with the file GET parameter.	CWE-22

21 Nov 2024 07:14Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.70933

carel pcoweb hvac bacnet gateway 2.1.0 firmware a2.1.0 b2.1.0 application software vulnerability unauthenticated file disclosure bash script logdownload.cgi directory traversal nvd cve-2022-37122