CVE-2021-37292

HighCVSS 7.2

Published: 11/04/2022(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

6.72%

93th percentile - higher than 93% of all known CVEs

Summary

An undocumented backdoor account in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 allows unauthorized access with full administrative privileges. The vulnerability stems from missing access controls and a hidden account.

Risk Assessment

An attacker can gain complete control over the BEMS system, leading to data integrity breaches, disruption of building infrastructure, and potential use of the system for further attacks.

Recommendation

Immediately change default passwords, remove or disable the backdoor account, and implement strong multi-factor authentication. Also update the software to the latest version.

Original NVD description (English source)

An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious user can log in using the backdor account with admin highest privileges and obtain system control.