Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal

Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the 'file' GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication. id: CVE-2022-37122...

building_automation_system_guardian

BAS Guardian - Free Building Automation System BAS Security...

Reliable Controls MACH-Pro - Login Panel Detection

Reliable Controls MACH-ProWebSys is a web-based building controller for HVAC, lighting, and energy management using BACnet/IP. These controllers are widely deployed in commercial buildings across North America and are often directly internet-facing with no VPN protection. !/usr/bin/env python3 --...

CAREL Boss Mini - Login Panel Detected

CAREL Boss Mini login panel was detected. Boss Mini is a local supervisor solution by CAREL used for monitoring and managing HVAC/R systems in commercial facilities. Exposed panels may indicate misconfigured network segmentation. !/usr/bin/env python3 -- coding: utf-8 -- """CAREL Boss Mini login...

Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal Detection

Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the 'file' GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication. !/usr/bin/env python...

Enhancing Attack Detection Capabilities in BACnet/IP Networks Using Machine-Learning Models

Building Automation Systems BAS manage critical building functions using protocols such as BACnet/IP, yet defenders have limited tooling and few labeled datasets for detecting BACnet-specific attacks. This work addresses these gaps through three contributions. First, CISA's Zeek BACnet parser is...

Schneider Electric Ecostruxure Machine Expert HVAC security vulnerabilities

Schneider Electric Ecostruxure Machine Expert HVAC is a software platform developed by Schneider Electric, a French company, dedicated to the control and automation of heating, ventilation, and air conditioning equipment. Schneider Electric Ecostruxure Machine Expert HVAC has a security...

CVE-2026-27326: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme window-ac-services allows PHP Local File Inclusion.This issue affects AC Services | HVAC, Air...

EUVD-2016-5516

Malware in sbrugna...

EUVD-2014-7479

Malware in sbrugna...

EUVD-2014-6626

Malware in sbrugna...

EUVD-2017-16935

Malware in sbrugna...

EUVD-2019-16380

Malware in sbrugna...

EUVD-2017-16936

Malware in sbrugna...

EUVD-2021-28322

Malicious code in bioql PyPI...

EUVD-2025-4820

Malicious code in bioql PyPI...

EUVD-2022-35208

Malicious code in bioql PyPI...

HVAC-EAR: Eavesdropping Human Speech Using HVAC Systems

Pressure sensors are widely integrated into modern Heating, Ventilation and Air Conditioning HVAC systems. As they are sensitive to acoustic pressure, they can be a source of eavesdropping. This paper introduces HVAC-EAR, which reconstructs intelligible speech from low-resolution, noisy pressure...

Samsung HVAC DMS

RISK EVALUATION Successful exploitation of these vulnerabilities can lead to unauthenticated remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all...

CVE-2022-2988

A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software. Affected Products: SoMachine HVAC Versions prior to V2.1.0, EcoStruxure Machine Expert – HVAC Versions prior to V1.4.0...