Lucene search
PRIOn knowledge basePRION:CVE-2022-37122HistoryAug 31, 2022 - 4:15 p.m.
Directory traversal
2022-08-3116:15:00
PRIOn knowledge base
www.prio-n.com
1
carel pcoweb
hvac bacnet gateway
firmware a2.1.0
application software 2.15.4a
directory traversal
Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the ‘file’ GET parameter through the ‘logdownload.cgi’ Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
| CPE | Name | Operator | Version |
|---|---|---|---|
| applica | eq | 2.154.97 | |
| applica | eq | 16.0.13020200 | |
| pcoweb_card_firmware | eq | >= a2.1.0 AND <= b.2.1.0 | |
| pcoweb_hvac_bacnet_gateway | eq | 2.1.0 |
Related
zeroscience
zeroscience
Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal
2022-06-30 00:00:00
nvd
nvd
CVE-2022-37122
2022-08-31 16:15:11
cve
cve
CVE-2022-37122
2022-08-31 16:15:11
cvelist
cvelist
CVE-2022-37122
2022-08-31 15:47:57