Longjing Technology BEMS API <= 1.21 Remote Arbitrary File Download

Advisories

severity: high
date: November 12, 2025
Affecting: Battery Energy Management System (BEMS) API <= 1.21
An affected version range remains undefined
CVE: CVE-2021-4463
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-552 Files or Directories Accessible to External Parties
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References: Zero Science Lab Disclosure
ExploitDB-50163
Packet-Storm-Security-163702
CXSecurity-WLB-2021070173
IBM-X-Force-206477
Longjing Technology Product Site
Credit: Gjoko Krstic of Zero Science Lab
Description: Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.