Carel
11 CVEs across 12 Carel products. Browse Carel vulnerabilities, severities, and proof-of-concept exploits.
Carel products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3643 | High | 7.3 | 2023-07-12 | A vulnerability was found in Boss Mini 1.4.0 Build 6221. It has been classified as critical. This affects an unknown part of the file boss/servlet/document. Th… |
CVE-2020-18329 | High | 7.5 | 2023-01-26 | An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access… |
CVE-2022-34827 | Critical | 9.9 | 2022-11-18 | Carel Boss Mini 1.5.0 has Improper Access Control. |
CVE-2022-37122 | High | 7.5 | 2022-08-31 | Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrar… |
CVE-2019-13553 | Critical | 9.8 | 2019-10-25 | Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured… |
CVE-2019-13549 | High | 7.5 | 2019-10-25 | Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not prov… |
CVE-2019-11370 | Medium | 5.4 | 2019-06-03 | Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field. |
CVE-2019-11369 | High | 8.8 | 2019-06-03 | An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext passwords, which may allow sensitive inform… |
CVE-2019-9484 | High | 7.5 | 2019-03-01 | The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10… |
CVE-2016-0867 | High | 7.5 | 2016-01-30 | CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request. |
CVE-2011-3487 | | 2011-09-16 | Directory traversal vulnerability in CarelDataServer.exe in Carel PlantVisor 2.4.4 and earlier allows remote attackers to read arbitrary files via a .. (dot do… |