CVE

CVE-2022-37122

7.5

CVSS

Description

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

Attack Vector

Privileges Req.

User Interaction

Updated Sep 18, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

CVE-2022-37122 Scanner

Targets the web interface of Carel pCOWeb HVAC BACnet Gateway to read arbitrary files via directory traversal, exposing sensitive configuration data.

Used 3.2k times · 5.9k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →