CVE-2022-37122

HIGHNuclei

Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-37122 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Repository PoCs

GitHubbughuntar/CVE-2022-37122-ExploitRepository PoCby bughuntar12Scanner3 files

877.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Bash script that sends HTTP requests with a path traversal payload to detect CVE-2022-37122 in Carel pCOWeb devices. It classifies targets as VULNERABLE, POSSIBLE, or NOT_DETECTED based on response content and saves evidence samples, but does not exploit the vulnerability to exfiltrate arbitrary files beyond the configured payload.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and cve-2022-37122-scanner.sh) implement a path traversal scanner for CVE-2022-37122. The script sends HTTP requests to a target's logdownload.cgi endpoint with a configurable traversal payload (defaulting to /etc/hostname) and records the response. No backdoor, concealed operator-directed harm, or deceptive payload targeting the person running the PoC was observed. The script's behavior is consistent with its stated purpose of vulnerability scanning.

ClassificationScanner
Model confidence98%
AuthenticationNot required
Languagesbash
Target softwareCarel pCOWeb HVAC BACnet Gateway
Attack typespath traversaldirectory traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only probes for the vulnerability by sending a single configurable payload and analyzing the response to determine if the target is vulnerable. It does not attempt to read arbitrary files beyond the configured payload, establish a shell, or perform any post-exploitation actions. The README explicitly describes it as a 'scanner' and 'detection' tool.

README.md:1README.md:7cve-2022-37122-scanner.sh:5cve-2022-37122-scanner.sh:124-172

Requirements

  • Target URL(s) of Carel pCOWeb devicescve-2022-37122-scanner.sh:82-83
  • Network access to target devicescve-2022-37122-scanner.sh:132

Observed behavior

  • Sends HTTP GET request to /usr-cgi/logdownload.cgi?file=<payload> on targetcve-2022-37122-scanner.sh:132-145
  • Classifies target as VULNERABLE if response first non-empty line matches hostname regexcve-2022-37122-scanner.sh:152-159
  • Classifies target as POSSIBLE if response contains hostname-related keywordscve-2022-37122-scanner.sh:162-167
  • Saves response samples to disk for manual verificationcve-2022-37122-scanner.sh:155-156
  • Outputs results in CSV format with host, url, status, matched_pattern, sample_filecve-2022-37122-scanner.sh:84-89
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
Payload withheldThe script sends a GET request to the target with a path traversal payload to test for CVE-2022-37122.cve-2022-37122-scanner.sh:132-145
File Write
Payload withheldThe script writes HTTP response bodies to local files for evidence collection.cve-2022-37122-scanner.sh:155-156
Package Install
Payload withheldThe script attempts to install figlet for banner display, which requires sudo privileges.cve-2022-37122-scanner.sh:53
Review boundaries

What the analysis did not establish

  • One non-text file (banner.png) was not analyzed; it is unlikely to change classification.
  • Evidence coverage is complete for readable selected text files.
  • One non-text file (banner.png) was present in the repository but not analyzed; it could contain steganographic or malicious content, though this is unlikely given the context.
  • The review is limited to the static source code; runtime behavior or external dependencies (e.g., curl) were not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryHIGHCarel pCOWeb HVAC BACnet Gateway 2.1.0 - Path TraversalCVSS 7.5

Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the 'file' GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication.

Impact

Unauthenticated attackers can read arbitrary files from the Carel pCOWeb HVAC BACnet Gateway through directory traversal in the logdownload.cgi file parameter, potentially exposing sensitive configuration files, credentials, and HVAC system data.

Remediation

Update Carel pCOWeb HVAC BACnet Gateway to a version later than 2.1.0 that properly validates file paths in logdownload.cgi.

WeaknessesCWE-22
Authorsgy741
Template tagscvecve2022carellfitraversalunauthbacnetvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5709.php https://www.zeroscience.mk/codes/carelpco_dir.txt https://packetstormsecurity.com/files/167684/ https://nvd.nist.gov/vuln/detail/CVE-2022-37122

Source: ProjectDiscovery

References

4