EIP-2026-101580

The exploit demonstrates an unauthenticated directory traversal vulnerability in Carel pCOWeb HVAC BACnet Gateway 2.1.0 via the 'file' parameter in 'logdownload.cgi', allowing arbitrary file disclosure. The provided curl command successfully retrieves '/etc/passwd'.