Carel pCOWeb HVAC BACnet gateway 2.1.0 (logdownload.cgi): Unauthenticated arbitrary file read off the gateway

Impact

Unauthenticated arbitrary file read off the gateway that bridges your BACnet field bus to IP. On its own that is information disclosure, but on this class of device the files worth reading are the ones that turn into control: stored web credentials, the BACnet device map, SNMP community strings, and the config that tells an attacker exactly which object instance is the CRAH fan-speed command and which is the chilled-water setpoint. This is the reconnaissance step that makes a subsequent thermal attack precise instead of a guess. Carel pCOWeb cards sit inside a very long list of OEM cooling products (chillers, CRAC/CRAH units, close-coupled cooling), so operators frequently have these in the hall without knowing the Carel name appears anywhere in their asset list.

Who can reach it

Unauthenticated HTTP GET on the facility network. No credentials, no user interaction. Reachability is the whole question: if your mechanical VLAN is flat with anything an attacker can phish into, this is a one-request win. These gateways also turn up on remote-access boxes that the mechanical contractor installed for support, which is how they end up internet-reachable.

What to do

Carel firmware updates for pCOWeb are distributed through the OEM that embedded the card, not directly, so the practical path is: identify which of your cooling units carry a pCOWeb card (check the cooling vendor's BOM, not your CMDB), then ask that OEM for a firmware level that closes it. Expect a field technician and a maintenance window on live cooling, which most operators will not schedule for a file-read bug - so plan on segmentation as the actual control. Deny the gateway's web port from everything except the BMS supervisor, and log all access to it.

References