CVE-2022-37122: Carel Applica

High severity, CVSS 7.5. EPSS: 23.1% chance of exploitation in the next 30 days.

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

Affected products

• Carel Applica: version 2.154a only; version 16_13020200 only
• Carel Pcoweb Card Firmware: from a2.1.0, up to and including b.2.1.0
• Carel Pcoweb Hvac Bacnet Gateway: version 2.1.0 only

Published 2022-08-31. Last modified 2026-06-17.