what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal

Posted Jul 1, 2022

Authored by LiquidWorm | Site zeroscience.mk

Carel pCOWeb HVAC BACnet Gateway version 2.1.0 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the file GET parameter through the logdownload.cgi bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

tags | exploit, arbitrary, cgi, bash

SHA-256 | 6080b06695bafffc697537b01af1fe9b2c39e6c9237b59563f645f36adbc81cb

Download | Favorite | View

Related Files

No related files