CVE-2021-37292

An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious user can log in using the backdor account with admin highest privileges and obtain system control.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

6.55% chance of exploitation in the next 30 days, 93th percentile

Nuclei

high

Published

2022-04-11

Updated

2026-07-05

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-37292.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-37291
• CVE-2021-37304
• CVE-2021-3728
• CVE-2021-37305
• CVE-2021-37253
• CVE-2021-37315