CVE-2021-4463CWE-22CWE-552

Longjing Technology BEMS API <= 1.21 Remote Arbitrary File Download

High · published November 12, 2025

CVSS v4.0
8.7
EPSS
2%
Percentile
75.0
In the wild
Unconfirmed
What it is

Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.01556 · 75.0th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-552 · Files or Directories Accessible to External Parties
Published
2025-11-12T22:07Z
EPSS history
Timeline
  • 12 NOV 22:07Z
    Longjing Technology BEMS API <= 1.21 Remote Arbitrary File Download
    cvelistv5