CVE-2022-37122 — AI Deep Analysis Summary

🚨 **Essence**: Unauthenticated Arbitrary File Disclosure via Path Traversal. 💥 **Consequences**: Attackers can read sensitive system files by manipulating the `file` parameter in `logdownload.cgi`.…

🛡️ **Root Cause**: Improper Input Validation. The `logdownload.cgi` Bash script fails to sanitize the `file` GET parameter before processing.…

🏭 **Affected Product**: Carel pCOWeb HVAC BACnet Gateway.…

🕵️ **Attacker Actions**: Read arbitrary files from the device's filesystem. 📂 **Data Impact**: Sensitive logs, configuration files, or potentially credential stores. 🔓 **Privileges**: No authentication required!…

📉 **Threshold**: **LOW**. 🚫 **Auth**: None required. 📝 **Config**: Standard HTTP GET request manipulation.…

🔥 **Public Exploit**: **YES**. - **Nuclei Template**: Available in projectdiscovery/nuclei-templates. - **Scanner**: Dedicated Bash scanner available at `bughuntar/CVE-2022-37122-Exploit`.…

🔍 **Self-Check Method**: 1. Send a GET request to `/logdownload.cgi?file=../../../../etc/passwd` (or similar sensitive path). 2. Use Nuclei with the CVE-2022-37122 template. 3.…

🛠️ **Official Fix**: The provided data does **not** contain a specific patch link or version number indicating a fix. It only lists references to vulnerability disclosures (ZeroScience, PacketStorm).…

🚧 **Workaround**: 1. **Network Segmentation**: Restrict access to the BACnet Gateway to trusted IPs only. 2. **WAF Rules**: Block requests containing `../` or null bytes in the `file` parameter. 3.…

🔴 **Priority**: **HIGH**. 🚨 **Reason**: Unauthenticated, easy to exploit, and affects industrial control systems (HVAC). Data leakage risk is significant.…