bughuntar/CVE-2022-37122-Exploit

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Bash script that sends HTTP requests with a path traversal payload to detect CVE-2022-37122 in Carel pCOWeb devices. It classifies targets as VULNERABLE, POSSIBLE, or NOT_DETECTED based on response content and saves evidence samples, but does not exploit the vulnerability to exfiltrate arbitrary files beyond the configured payload.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and cve-2022-37122-scanner.sh) implement a path traversal scanner for CVE-2022-37122. The script sends HTTP requests to a target's logdownload.cgi endpoint with a configurable traversal payload (defaulting to /etc/hostname) and records the response. No backdoor, concealed operator-directed harm, or deceptive payload targeting the person running the PoC was observed. The script's behavior is consistent with its stated purpose of vulnerability scanning.

ClassificationScanner
Model confidence98%
AuthenticationNot required
Languagesbash
Target softwareCarel pCOWeb HVAC BACnet Gateway
Attack typespath traversaldirectory traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only probes for the vulnerability by sending a single configurable payload and analyzing the response to determine if the target is vulnerable. It does not attempt to read arbitrary files beyond the configured payload, establish a shell, or perform any post-exploitation actions. The README explicitly describes it as a 'scanner' and 'detection' tool.

README.md:1README.md:7cve-2022-37122-scanner.sh:5cve-2022-37122-scanner.sh:124-172

Requirements

  • Target URL(s) of Carel pCOWeb devicescve-2022-37122-scanner.sh:82-83
  • Network access to target devicescve-2022-37122-scanner.sh:132

Observed behavior

  • Sends HTTP GET request to /usr-cgi/logdownload.cgi?file=<payload> on targetcve-2022-37122-scanner.sh:132-145
  • Classifies target as VULNERABLE if response first non-empty line matches hostname regexcve-2022-37122-scanner.sh:152-159
  • Classifies target as POSSIBLE if response contains hostname-related keywordscve-2022-37122-scanner.sh:162-167
  • Saves response samples to disk for manual verificationcve-2022-37122-scanner.sh:155-156
  • Outputs results in CSV format with host, url, status, matched_pattern, sample_filecve-2022-37122-scanner.sh:84-89
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
curl request to /usr-cgi/logdownload.cgi?file=<payload>The script sends a GET request to the target with a path traversal payload to test for CVE-2022-37122.cve-2022-37122-scanner.sh:132-145
File Write
saves response samples to samples/ directoryThe script writes HTTP response bodies to local files for evidence collection.cve-2022-37122-scanner.sh:155-156
Package Install
sudo apt install figletThe script attempts to install figlet for banner display, which requires sudo privileges.cve-2022-37122-scanner.sh:53
Review boundaries

What the analysis did not establish

  • One non-text file (banner.png) was not analyzed; it is unlikely to change classification.
  • Evidence coverage is complete for readable selected text files.
  • One non-text file (banner.png) was present in the repository but not analyzed; it could contain steganographic or malicious content, though this is unlikely given the context.
  • The review is limited to the static source code; runtime behavior or external dependencies (e.g., curl) were not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1