CVE-2021-37293
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
A Directory Traversal vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can exploit the 'page' parameter in index.php to read arbitrary files on the server.
Risk Assessment
Risk of unauthorized access to sensitive configuration files, system data, or other resources, potentially leading to information disclosure and further attack escalation.
Recommendation
Immediately update the system to the latest version or apply a security patch. If unavailable, restrict access to the admin panel and validate the 'page' parameter.
Other vulnerabilities in KevinLAB Inc Building Energy Management System 4ST BEMS
See all- CVE-2021-37292High
An undocumented backdoor account in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 allows unauthorized access with full administrative privileges. The vulnerability stems from missing access controls and a hidden account.
- CVE-2021-37291Critical
SQL Injection vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can inject malicious SQL queries via the input_id POST parameter in index.php.
Original NVD description (English source)
A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS