CVE-2022-37122: carel pcoweb card firmware +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-37122

CVSS 7.5 · High EPSS 23,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada carel pcoweb card firmware, carel applica +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

Rincian

Terbit di NVD: 31 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 23,1% peluang dieksploitasi; lebih tinggi dari 97,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
carel	pcoweb card firmware	Versi a2.1.0 hingga b.2.1.0
carel	applica	Versi 2.154a
carel	applica	Versi 16_13020200
carel	pcoweb hvac bacnet gateway	Versi 2.1.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://packetstormsecurity.com/files/167684/ exploit · advisory pihak ketiga · vdb entry
https://www.zeroscience.mk/codes/carelpco_dir.txt exploit · advisory pihak ketiga
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.