Carel

Records11All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

Carel records in CISA KEV

No Carel vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pcoweb Card Firmware 4 records MEDIUM Boss Mini Firmware 2 records HIGH Pcoweb Firmware 2 records MEDIUM Applica 1 record MEDIUM Pcoweb Card Bios 1 record MEDIUM Pcoweb Card Boot 1 record MEDIUM Pcoweb Card Web 1 record MEDIUM Pcoweb Hvac Bacnet Gateway 1 record MEDIUM

Records

11 records

TI-2023-03400 CVE-2023-3643 · GHSA-6p6c-jp3p-772m

Boss Mini document file inclusion

HIGH 81

A vulnerability was found in Boss Mini 1.4.0 Build 6221.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.75363 Published 2023-07-12 No fix listed CWE-73

TI-2022-15634 CVE-2022-34827 · GHSA-5w9h-x2v4-5xm7

Carel Boss Mini 1.5.0 has Improper Access Control.

HIGH 76

Carel Boss Mini 1.5.0 has Improper Access Control.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00841 Published 2022-11-18 No fix listed CWE-284

TI-2022-17297 CVE-2022-37122 · GHSA-wwr2-w2jp-vx63

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software…

MEDIUM 53

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.23518 Published 2022-08-31 No fix listed CWE-22

TI-2019-08491 CVE-2019-11369 · GHSA-32g4-rrf2-hwj9

An issue was discovered in Carel pCOWeb prior to B1.2.4.

MEDIUM 49

An issue was discovered in Carel pCOWeb prior to B1.2.4.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.08144 Published 2019-06-03 No fix listed CWE-522

TI-2019-10185 CVE-2019-13553 · GHSA-6j53-rvq8-q9pr

Hard-coded credentials in Rittal Chiller SK 3232-Series

MEDIUM 46

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02297 Published 2019-10-25 No fix listed CWE-798

TI-2020-13369 CVE-2020-18329 · GHSA-5ccq-w6wj-jcqq

An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00…

MEDIUM 41

An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access to the configuration and service interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00944 Published 2023-01-25 No fix listed CWE-281

TI-2016-00781 CVE-2016-0867 · GHSA-6j72-3f85-25j7

CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.

LOW 37

CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02196 Published 2016-01-30 No fix listed CWE-200

TI-2019-06921 CVE-2019-9484 · GHSA-v38p-xqmg-rfqf

The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool…

LOW 36

The Glen Dimplex Deutschland GmbH implementation of the Carel pCOWeb configuration tool allows remote attackers to obtain access via an HTTP session on port 10000, as demonstrated by reading the modem password (which is…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0151 Published 2019-03-01 No fix listed CWE-306

TI-2019-10181 CVE-2019-13549 · GHSA-73fc-m42q-9fv3

Missing authentication in Rittal Chiller SK 3232-Series

LOW 35

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01035 Published 2019-10-25 No fix listed CWE-306

TI-2011-03067 CVE-2011-3487 · GHSA-7gmm-x5mv-whxx

Directory traversal vulnerability in CarelDataServer.exe in Carel PlantVisor 2.4.4 and…

LOW 33

Directory traversal vulnerability in CarelDataServer.exe in Carel PlantVisor 2.4.4 and earlier allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07426 Published 2011-09-16 No fix listed CWE-22

TI-2019-08492 CVE-2019-11370 · GHSA-pfc4-fr5v-j7rh

Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the…

LOW 32

Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.04935 Published 2019-06-03 No fix listed CWE-79

Open these records in search →

Critical	3
High	6
Medium	2
Low	0
No CVSS	0