CVE-2022-37122

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://packetstormsecurity.com/files/167684/Exploit, Third Party Advisory, VDB Entry
https://www.zeroscience.mk/codes/carelpco_dir.txtExploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.phpExploit, Third Party Advisory
https://packetstormsecurity.com/files/167684/Exploit, Third Party Advisory, VDB Entry
https://www.zeroscience.mk/codes/carelpco_dir.txtExploit, Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.phpExploit, Third Party Advisory

Timeline

Published: Aug 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-371238.8D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi.CVE-2022-371259.8D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.CVE-2022-371289.8In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.CVE-2022-371298.8D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in the command paramete CVE-2022-37138.8A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than versi CVE-2022-371309.8In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the cond CVE-2022-371337.5D-link DIR-816 A2_v1.10CNB04.img reboots the router without authentication via /goform/doReboot. No authentication is required, and reboot i CVE-2022-371349.8D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypte CVE-2022-371375.4PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket. The XSS can be obtain from injecting under "Mess CVE-2022-371389.8Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after CVE-2022-371395.4Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability.CVE-2022-37149.8A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function