CVE-2022-37122 - CVE House
Back to Database
Status published High CVE-2022-37122

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0,...

Vulnerability Description

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-37122

Credits & Attribution

No credits recorded in the NVD database.

References

More from carel

View All →
CVE-2022-34827
Carel Boss Mini 1.5.0 has Improper Access Control....
Unknown 0
CVE-2020-18329
An issue was discovered in Rehau devices that use a...
Unknown 0
CVE-2019-9484
The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb...
High 7.5
CVE-2019-11370
Stored XSS was discovered in Carel pCOWeb prior to B1.2.4,...
Medium 5.4
CVE-2019-11369
An issue was discovered in Carel pCOWeb prior to B1.2.4....
High 8.8

Affected Vendor

Affected Software

pcoweb card firmware, applica, pcoweb hvac bacnet gateway
Vulnerable Versions:
a2.1.0, 2.154a, 16_13020200, 2.1.0

Timeline

Official Publish: August 31st, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.