PT-2025-46728 · Longjing Technology · Longjing Technology Bems Api

Gjoko Krstic · Published 2025-11-12 · Updated 2025-11-13 · CVE-2021-4463

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Longjing Technology BEMS API versions up to and including 1.21

Description The software contains an unauthenticated arbitrary file download issue in the 'downloads' endpoint. The fileName parameter lacks proper sanitization, enabling attackers to construct file traversal sequences and gain access to sensitive files outside the designated directory.

Recommendations Apply updates to versions prior to 1.21.

Exploit

Fix

Path traversal

Files Accessible to External Parties

Weakness Enumeration

CWE-22

CWE-552

Related Identifiers

CVE-2021-4463

Affected Products

Longjing Technology Bems Api

References · 9

• 🔥 https://exploit-db.com/exploits/50163 · Exploit
• 🔥 https://packetstormsecurity.com/files/163702 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2021070173 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-4463 · Security Note
• https://twitter.com/CVEnew/status/1988820417126232427 · Twitter Post
• https://vulncheck.com/advisories/longjing-technology-bems-api-remote-arbitrary-file-download · Note
• https://web.archive.org/web/20220527162453/http://ljkj2012.com · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/206477 · Note