CVE-2021-37292
HighCVSS 7.2Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
An undocumented backdoor account in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 allows unauthorized access with full administrative privileges. The vulnerability stems from missing access controls and a hidden account.
Risk Assessment
An attacker can gain complete control over the BEMS system, leading to data integrity breaches, disruption of building infrastructure, and potential use of the system for further attacks.
Recommendation
Immediately change default passwords, remove or disable the backdoor account, and implement strong multi-factor authentication. Also update the software to the latest version.
Other vulnerabilities in KevinLAB Inc Building Energy Management System 4ST BEMS
See all- CVE-2021-37291Critical
SQL Injection vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can inject malicious SQL queries via the input_id POST parameter in index.php.
- CVE-2021-37293Medium
A Directory Traversal vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can exploit the 'page' parameter in index.php to read arbitrary files on the server.
Original NVD description (English source)
An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious user can log in using the backdor account with admin highest privileges and obtain system control.