CVE Catalog
CVE-2021-37293
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk1.42%
70th percentile - higher than 70% of all known CVEs
Summary
A Directory Traversal vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can exploit the 'page' parameter in index.php to read arbitrary files on the server.
Risk Assessment
Risk of unauthorized access to sensitive configuration files, system data, or other resources, potentially leading to information disclosure and further attack escalation.
Recommendation
Immediately update the system to the latest version or apply a security patch. If unavailable, restrict access to the admin panel and validate the 'page' parameter.
Original NVD description (English source)
A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php.