Shenzhen Longjing BEMS API up to 1.21 fileName file access

Summaryinfo

A vulnerability labeled as problematic has been found in Shenzhen Longjing BEMS API up to 1.21. Affected by this issue is some unknown functionality. Such manipulation of the argument fileName leads to file access. This vulnerability is referenced as CVE-2021-4463. It is possible to launch the attack remotely. Furthermore, an exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Shenzhen Longjing BEMS API up to 1.21. Affected by this issue is an unknown part. The manipulation of the argument fileName with an unknown input leads to a file access vulnerability. Using CWE to declare the problem leads to CWE-552. The product makes files or directories accessible to unauthorized actors, even though they should not be. Impacted is confidentiality. CVE summarizes:

Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.

The weakness was published by Gjoko Krstic as 163702. The advisory is shared for download at zeroscience.mk. This vulnerability is handled as CVE-2021-4463 since 11/12/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1083.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (206477) and Exploit-DB (50163). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• Shenzhen Longjing

Name

• BEMS API

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion